CVE-2018-25195
Published: 26 March 2026
Summary
CVE-2018-25195 is a high-severity SQL Injection (CWE-89) vulnerability in Wecodex Hotel Cms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2018-25195 is an SQL injection vulnerability affecting Wecodex Hotel CMS version 1.0, specifically in the admin login functionality. The flaw occurs through the username parameter in POST requests to index.php with action=processlogin, where insufficient input sanitization allows attackers to inject malicious SQL payloads. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, and no prerequisites for privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability to bypass authentication mechanisms, extract sensitive database information, or gain unauthorized administrative access. By submitting crafted SQL payloads via the vulnerable endpoint, attackers achieve high confidentiality impact through data exfiltration and low integrity impact potentially via limited data modification, without affecting availability.
Advisories from Vulncheck (https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login) provide details on the SQL injection via admin login, while a proof-of-concept exploit is available on Exploit-DB (https://www.exploit-db.com/exploits/44729). The vendor's page for the Hotel Management System in PHP and MySQL (https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7) is referenced, though specific patch or mitigation guidance is not detailed in available descriptions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21659
Vulnerability details
Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php…
more
with action=processlogin to extract sensitive database information or gain unauthorized administrative access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing admin login enables exploitation of public-facing application (T1190) for authentication bypass and unauthorized access; facilitates extraction of sensitive database information (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the username parameter in admin login POST requests to prevent SQL injection exploitation.
Enforces restrictions on information inputs such as character types and lengths for the username field to block SQL injection payloads.