Cyber Posture

CVE-2018-25195

HighPublic PoC

Published: 26 March 2026

Published
26 March 2026
Modified
27 March 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0049 65.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php…

more

with action=processlogin to extract sensitive database information or gain unauthorized administrative access.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation of untrusted inputs like the username parameter in admin login POST requests to prevent SQL injection exploitation.

prevent

Enforces restrictions

prevent

Enforces restrictions on information inputs such as character types and lengths for the username field to block SQL injection payloads.

Security SummaryAI

CVE-2018-25195 is an SQL injection vulnerability affecting Wecodex Hotel CMS version 1.0, specifically in the admin login functionality. The flaw occurs through the username parameter in POST requests to index.php with action=processlogin, where insufficient input sanitization allows attackers to inject malicious SQL payloads. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, and no prerequisites for privileges or user interaction.

Unauthenticated remote attackers can exploit this vulnerability to bypass authentication mechanisms, extract sensitive database information, or gain unauthorized administrative access. By submitting crafted SQL payloads via the vulnerable endpoint, attackers achieve high confidentiality impact through data exfiltration and low integrity impact potentially via limited data modification, without affecting availability.

Advisories from Vulncheck (https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login) provide details on the SQL injection via admin login, while a proof-of-concept exploit is available on Exploit-DB (https://www.exploit-db.com/exploits/44729). The vendor's page for the Hotel Management System in PHP and MySQL (https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7) is referenced, though specific patch or mitigation guidance is not detailed in available descriptions.

Details

CWE(s)

Affected Products

wecodex
hotel cms
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing admin login enables exploitation of public-facing application (T1190) for authentication bypass and unauthorized access; facilitates extraction of sensitive database information (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References