CVE-2018-25165
Published: 06 March 2026
Summary
CVE-2018-25165 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2018-25165 is an SQL injection vulnerability (CWE-89) affecting Galaxy Forces MMORPG version 0.5.8. The issue exists in the ads.php component, where the 'type' parameter fails to properly sanitize user input, allowing injection of malicious SQL code via POST requests.
Authenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. By crafting SQL payloads in the 'type' parameter, they can execute arbitrary SQL queries to extract sensitive database information, including usernames, databases, and version details. The CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact with low integrity impact and no availability impact.
Advisories and exploit details are documented in references including Exploit-DB (https://www.exploit-db.com/exploits/45864) and Vulncheck (https://www.vulncheck.com/advisories/galaxy-forces-mmorpg-sql-injection-via-adsphp). No specific patches or mitigation steps are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21620
Vulnerability details
Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'type' parameter. Attackers can send POST requests to ads.php with crafted SQL payloads in the type…
more
parameter to extract sensitive database information including usernames, databases, and version details.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a web-accessible component (ads.php) directly enables exploitation of a public-facing application to extract database contents.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all input parameters (including the unsanitized 'type' POST parameter) to block SQL injection payloads before they reach the database.
Enables continuous monitoring and analysis of application and database query logs to identify anomalous SQL statements originating from ads.php.
Limits the database privileges granted to the application account so that even a successful injection yields minimal additional data exposure beyond what the account already holds.