CVE-2018-25196
Published: 06 March 2026
Summary
CVE-2018-25196 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-25196 is an SQL injection vulnerability (CWE-89) affecting ServerZilla 1.0. The flaw resides in the reset.php component, where the email parameter fails to properly sanitize user input, allowing attackers to inject SQL code into database queries.
Unauthenticated remote attackers can exploit this vulnerability by sending POST requests to reset.php with malicious values in the email parameter, such as SQL operators. Successful exploitation enables bypassing authentication mechanisms and extracting sensitive information from the database. The issue carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact with low complexity and no required privileges.
Advisories and related resources, including the Vulncheck advisory at https://www.vulncheck.com/advisories/serverzilla-sql-injection-via-email-parameter and a proof-of-concept exploit at https://www.exploit-db.com/exploits/45817, provide further details on the vulnerability. The CVE was published on 2026-03-06.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21648
Vulnerability details
ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to reset.php with malicious email values containing SQL operators to bypass authentication…
more
and extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (reset.php) enables exploitation of public-facing application (T1190) and direct extraction of sensitive data from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of user inputs like the email parameter before incorporation into database queries.
SI-2 requires timely identification, reporting, and correction of flaws such as the unsanitized email parameter in reset.php, remediating the root cause of this CVE.
SI-9 enforces restrictions on inputs like the email parameter, such as format and length limits, to block malicious SQL payloads.