Cyber Posture

CVE-2018-25192

HighPublic PoC

Published: 06 March 2026

Published
06 March 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0031 53.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit crafted POST requests to the login.php endpoint with SQL injection payloads in the…

more

username field to gain unauthorized access without valid credentials.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires the system to validate inputs like the username parameter in login.php, directly preventing SQL injection exploitation.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely identification, reporting, and correction of flaws such as the SQL injection vulnerability in the GPS Tracking System.

RA-5 Vulnerability Monitoring and Scanning good match
prevent

RA-5 requires regular vulnerability scanning to detect and remediate SQL injection issues like CVE-2018-25192 before exploitation.

Security SummaryAI

CVE-2018-25192 is an SQL injection vulnerability (CWE-89) affecting GPS Tracking System version 2.12. The issue occurs in the login.php endpoint, where the username parameter fails to properly sanitize input, allowing attackers to inject SQL code.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted POST requests to the login.php endpoint with SQL injection payloads in the username field. This enables authentication bypass, granting unauthorized access to the system without valid credentials. The CVSS v3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact with low integrity impact and no availability impact.

Advisories provide further details on the vulnerability, including the Vulncheck advisory at https://www.vulncheck.com/advisories/gps-tracking-system-sql-injection-via-username-parameter and an Exploit-DB entry at https://www.exploit-db.com/exploits/45816.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing login.php enables unauthenticated remote authentication bypass, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References