Cyber Resilience

CVE-2018-25195

HighPublic PoC

Published: 26 March 2026

Published
26 March 2026
Modified
27 March 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0052 40.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2018-25195 is a high-severity SQL Injection (CWE-89) vulnerability in Wecodex Hotel Cms. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Deeper analysis

CVE-2018-25195 is an SQL injection vulnerability affecting Wecodex Hotel CMS version 1.0, specifically in the admin login functionality. The flaw occurs through the username parameter in POST requests to index.php with action=processlogin, where insufficient input sanitization allows attackers to inject malicious SQL payloads. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, and no prerequisites for privileges or user interaction.

Unauthenticated remote attackers can exploit this vulnerability to bypass authentication mechanisms, extract sensitive database information, or gain unauthorized administrative access. By submitting crafted SQL payloads via the vulnerable endpoint, attackers achieve high confidentiality impact through data exfiltration and low integrity impact potentially via limited data modification, without affecting availability.

Advisories from Vulncheck (https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login) provide details on the SQL injection via admin login, while a proof-of-concept exploit is available on Exploit-DB (https://www.exploit-db.com/exploits/44729). The vendor's page for the Hotel Management System in PHP and MySQL (https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7) is referenced, though specific patch or mitigation guidance is not detailed in available descriptions.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php…

more

with action=processlogin to extract sensitive database information or gain unauthorized administrative access.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing admin login enables exploitation of public-facing application (T1190) for authentication bypass and unauthorized access; facilitates extraction of sensitive database information (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25185Same vendor: Wecodex
CVE-2018-25204Same vendor: Wecodex
CVE-2018-25183Same vendor: Wecodex
CVE-2018-25201Same vendor: Wecodex
CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89

Affected Assets

wecodex
hotel cms
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of untrusted inputs like the username parameter in admin login POST requests to prevent SQL injection exploitation.

prevent

Enforces restrictions

prevent

Enforces restrictions on information inputs such as character types and lengths for the username field to block SQL injection payloads.

References