CVE-2018-25191
Published: 06 March 2026
Summary
CVE-2018-25191 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
Facturation System 1.0 is affected by CVE-2018-25191, an SQL injection vulnerability (CWE-89) in the editar_producto.php endpoint. The flaw arises from insufficient input validation on the 'mod_id' parameter, allowing attackers to inject malicious SQL code via POST requests. This enables the execution of arbitrary SQL queries against the underlying database.
Authenticated attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting payloads in the mod_id parameter, they can extract sensitive information such as usernames, database names, and version details, potentially leading to high confidentiality impacts as indicated by the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Advisories and exploit details are documented in references including Exploit-DB (https://www.exploit-db.com/exploits/45813) and VulnCheck (https://www.vulncheck.com/advisories/facturation-system-sql-injection-via-editar-productophp), which provide proof-of-concept exploits but do not specify patches or mitigations in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21644
Vulnerability details
Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod_id' parameter. Attackers can send POST requests to the editar_producto.php endpoint with crafted SQL payloads in the…
more
mod_id parameter to extract sensitive database information including usernames, database names, and version details.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in public-facing PHP endpoint (editar_producto.php) enables remote exploitation of the web application for arbitrary query execution and data extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'mod_id' input parameter in editar_producto.php to block crafted SQL payloads.
Limits the database privileges granted to the low-privilege authenticated account, reducing the impact of successful SQL queries that extract usernames and schema data.
Enables monitoring of POST requests and anomalous SQL patterns at the editar_producto.php endpoint to identify injection attempts in progress.