CVE-2018-25195
Published: 26 March 2026
Description
Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php…
more
with action=processlogin to extract sensitive database information or gain unauthorized administrative access.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of untrusted inputs like the username parameter in admin login POST requests to prevent SQL injection exploitation.
Enforces restrictions on information inputs such as character types and lengths for the username field to block SQL injection payloads.
Security SummaryAI
CVE-2018-25195 is an SQL injection vulnerability affecting Wecodex Hotel CMS version 1.0, specifically in the admin login functionality. The flaw occurs through the username parameter in POST requests to index.php with action=processlogin, where insufficient input sanitization allows attackers to inject malicious SQL payloads. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, and no prerequisites for privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability to bypass authentication mechanisms, extract sensitive database information, or gain unauthorized administrative access. By submitting crafted SQL payloads via the vulnerable endpoint, attackers achieve high confidentiality impact through data exfiltration and low integrity impact potentially via limited data modification, without affecting availability.
Advisories from Vulncheck (https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login) provide details on the SQL injection via admin login, while a proof-of-concept exploit is available on Exploit-DB (https://www.exploit-db.com/exploits/44729). The vendor's page for the Hotel Management System in PHP and MySQL (https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7) is referenced, though specific patch or mitigation guidance is not detailed in available descriptions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing admin login enables exploitation of public-facing application (T1190) for authentication bypass and unauthorized access; facilitates extraction of sensitive database information (T1213.006).