Cyber Posture

CVE-2018-25194

HighPublic PoC

Published: 06 March 2026

Published
06 March 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0024 47.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username parameter. Attackers can send POST requests to the login/checklogin.php endpoint with crafted UNION-based SQL injection payloads to…

more

extract database information including usernames, database names, and version details.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validating user inputs such as the username parameter to block malicious SQL injection payloads in POST requests to the login endpoint.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of flaws like the SQL injection vulnerability in Nominas 0.27's checklogin.php.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection with content inspection, such as web application firewalls, can filter and block UNION-based SQL injection attempts at the login endpoint.

Security SummaryAI

CVE-2018-25194 is an SQL injection vulnerability in Nominas version 0.27, affecting the login/checklogin.php endpoint. The flaw arises from improper handling of the username parameter, enabling attackers to inject malicious SQL code, particularly through UNION-based payloads, to execute arbitrary SQL queries against the underlying database.

Unauthenticated remote attackers can exploit this vulnerability with low complexity, requiring no privileges or user interaction, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending crafted POST requests to the login endpoint, attackers can extract sensitive database information, including usernames, database names, and version details, potentially leading to high confidentiality impacts with limited integrity disruption.

Mitigation details are available in related advisories, including the Vulncheck advisory at https://www.vulncheck.com/advisories/nominas-sql-injection-via-username-parameter and a proof-of-concept exploit at https://www.exploit-db.com/exploits/45820, which security practitioners should consult for patching guidance or input sanitization recommendations. The vulnerability is associated with CWE-22.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing login endpoint (T1190) enables arbitrary database queries to extract sensitive data such as usernames (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References