CVE-2018-25189
Published: 06 March 2026
Summary
CVE-2018-25189 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-25189 is an SQL injection vulnerability (CWE-89) in Data Center Audit version 2.6.2, specifically within the username parameter of the dca_login.php file. This flaw enables unauthenticated attackers to execute arbitrary SQL queries by submitting crafted payloads through POST requests, potentially compromising the underlying database.
The vulnerability can be exploited by unauthenticated remote attackers over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), resulting in a CVSS v3.1 base score of 8.2 (C:H/I:L/A:N). Exploitation allows attackers to extract sensitive information such as usernames, database names, and version details from the database.
Advisories and related resources, including those at https://www.vulncheck.com/advisories/data-center-audit-sql-injection-via-username-parameter and https://www.exploit-db.com/exploits/45807, document the issue and provide details on exploitation, such as proof-of-concept code. No specific patches or mitigation steps are detailed in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21642
Vulnerability details
Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames,…
more
database names, and version details.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing login endpoint (T1190) enables unauthenticated remote extraction of database contents including usernames and system details (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation mechanisms on inputs like the username parameter in dca_login.php to reject crafted SQL payloads.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in Data Center Audit 2.6.2 to eliminate the vulnerability.
Enables monitoring of system activity to detect unauthorized SQL queries or indicators of SQL injection exploitation attempts.