CVE-2018-25205
Published: 26 March 2026
Description
ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint…
more
to extract sensitive database information using boolean-based blind or error-based techniques.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the 'query' parameter to block malicious SQL payloads and prevent SQL injection exploitation.
Enforces error handling that suppresses database error details, mitigating error-based SQL injection techniques used to extract sensitive information.
Imposes restrictions on information inputs like the 'query' parameter to limit payload size, characters, or types that enable SQL injection.
Security SummaryAI
CVE-2018-25205 is an SQL injection vulnerability (CWE-89) affecting ASP.NET jVideo Kit 1.0. The flaw resides in the search functionality, where the 'query' parameter enables attackers to inject SQL commands via GET or POST requests to the /search endpoint. Published on 2026-03-26, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with low attack complexity.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By submitting malicious SQL payloads, they can extract sensitive database information using boolean-based blind or error-based techniques, potentially compromising data such as user credentials or other stored content.
Advisories and references, including Exploit-DB (https://www.exploit-db.com/exploits/44739), the vendor page (https://www.mediasoftpro.com/video-sharing-script/mvc/), and Vulncheck (https://www.vulncheck.com/advisories/asp-net-jvideo-kit-sql-injection-via-query-parameter), provide further details on the issue, though specific patch or mitigation guidance is not detailed in the CVE description. Security practitioners should review these for remediation steps, such as input sanitization or upgrading the software.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/search endpoint) enables unauthenticated remote exploitation (T1190) to extract sensitive database information including credentials (T1213.006).