CVE-2018-25194
Published: 06 March 2026
Summary
CVE-2018-25194 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-25194 is an SQL injection vulnerability in Nominas version 0.27, affecting the login/checklogin.php endpoint. The flaw arises from improper handling of the username parameter, enabling attackers to inject malicious SQL code, particularly through UNION-based payloads, to execute arbitrary SQL queries against the underlying database.
Unauthenticated remote attackers can exploit this vulnerability with low complexity, requiring no privileges or user interaction, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending crafted POST requests to the login endpoint, attackers can extract sensitive database information, including usernames, database names, and version details, potentially leading to high confidentiality impacts with limited integrity disruption.
Mitigation details are available in related advisories, including the Vulncheck advisory at https://www.vulncheck.com/advisories/nominas-sql-injection-via-username-parameter and a proof-of-concept exploit at https://www.exploit-db.com/exploits/45820, which security practitioners should consult for patching guidance or input sanitization recommendations. The vulnerability is associated with CWE-22.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21647
Vulnerability details
Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username parameter. Attackers can send POST requests to the login/checklogin.php endpoint with crafted UNION-based SQL injection payloads to…
more
extract database information including usernames, database names, and version details.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing login endpoint (T1190) enables arbitrary database queries to extract sensitive data such as usernames (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating user inputs such as the username parameter to block malicious SQL injection payloads in POST requests to the login endpoint.
Mandates timely identification, reporting, and correction of flaws like the SQL injection vulnerability in Nominas 0.27's checklogin.php.
Boundary protection with content inspection, such as web application firewalls, can filter and block UNION-based SQL injection attempts at the login endpoint.