CVE-2018-25202
Published: 26 March 2026
Summary
CVE-2018-25202 is a high-severity SQL Injection (CWE-89) vulnerability in Wecodex (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-25202 is an SQL injection vulnerability (CWE-89) in SAT CFDI 3.3, affecting the signIn endpoint through the 'id' parameter. It enables attackers to inject SQL code into database queries via POST requests, supporting boolean-based blind, stacked queries, or time-based blind techniques. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By crafting malicious payloads in the 'id' parameter, they can extract sensitive data from the database or compromise the application, such as through data exfiltration or further query manipulation.
References including an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/44726), a VulnCheck advisory (https://www.vulncheck.com/advisories/sat-cfdi-sql-injection-via-signin-endpoint), and a WeCodex entry (https://www.wecodex.com/item/view/verification-and-validation-system-sat-cfdi-33/8) document the issue, with the exploit confirming practical exploitation paths.
An exploit is publicly available on Exploit-DB, indicating potential for real-world abuse against unpatched SAT CFDI 3.3 instances. The CVE was published on 2026-03-26.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21663
Vulnerability details
SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in the signIn endpoint. Attackers can submit POST requests with boolean-based blind, stacked queries, or time-based blind…
more
SQL injection payloads to extract sensitive data or compromise the application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a public-facing web application via SQL injection on the signIn endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of the 'id' parameter in the signIn endpoint to block malicious payloads.
SI-9 enforces restrictions on the 'id' parameter, such as numeric-only input and length limits, to stop boolean-based blind, stacked, or time-based SQL injection attempts.
SI-2 ensures timely identification and remediation of the specific SQL injection flaw in CVE-2018-25202 via patching or code correction.