CVE-2018-25167

HighPublic PoC

Published: 06 March 2026

Published

06 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0023 13.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2018-25167 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2018-25167 is an SQL injection vulnerability (CWE-89) in Net-Billetterie version 2.9, specifically within the login parameter of the login.inc.php file. Published on 2026-03-06, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact. The vulnerability enables execution of arbitrary SQL queries due to insufficient input validation on the login POST parameter.

Unauthenticated remote attackers can exploit this vulnerability by submitting crafted SQL payloads via the login parameter during authentication attempts. Exploitation allows attackers to extract sensitive database contents, such as usernames, passwords, and system credentials, potentially compromising the application's data integrity and user accounts.

Advisories referenced at https://www.exploit-db.com/exploits/45863 and https://www.vulncheck.com/advisories/net-billetterie-sql-injection-via-loginincphp detail the vulnerability, including proof-of-concept exploit code.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2018-21622

Vulnerability details

Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit malicious SQL code through the login POST parameter to extract database information including usernames, passwords,…

and system credentials.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection vulnerability in public-facing web login enables unauthenticated exploitation of public-facing application (T1190) and arbitrary query extraction of sensitive database contents including credentials (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0