Cyber Resilience

CVE-2018-25205

HighPublic PoC

Published: 26 March 2026

Published
26 March 2026
Modified
26 March 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 18.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2018-25205 is a high-severity SQL Injection (CWE-89) vulnerability in Mediasoftpro (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).

Deeper analysis

CVE-2018-25205 is an SQL injection vulnerability (CWE-89) affecting ASP.NET jVideo Kit 1.0. The flaw resides in the search functionality, where the 'query' parameter enables attackers to inject SQL commands via GET or POST requests to the /search endpoint. Published on 2026-03-26, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with low attack complexity.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By submitting malicious SQL payloads, they can extract sensitive database information using boolean-based blind or error-based techniques, potentially compromising data such as user credentials or other stored content.

Advisories and references, including Exploit-DB (https://www.exploit-db.com/exploits/44739), the vendor page (https://www.mediasoftpro.com/video-sharing-script/mvc/), and Vulncheck (https://www.vulncheck.com/advisories/asp-net-jvideo-kit-sql-injection-via-query-parameter), provide further details on the issue, though specific patch or mitigation guidance is not detailed in the CVE description. Security practitioners should review these for remediation steps, such as input sanitization or upgrading the software.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint…

more

to extract sensitive database information using boolean-based blind or error-based techniques.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web application (/search endpoint) enables unauthenticated remote exploitation (T1190) to extract sensitive database information including credentials (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89
CVE-2019-25526Shared CWE-89
CVE-2025-69365Shared CWE-89
CVE-2019-25573Shared CWE-89

Affected Assets

Mediasoftpro
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of the 'query' parameter to block malicious SQL payloads and prevent SQL injection exploitation.

prevent

Enforces error handling that suppresses database error details, mitigating error-based SQL injection techniques used to extract sensitive information.

prevent

Imposes restrictions on information inputs like the 'query' parameter to limit payload size, characters, or types that enable SQL injection.

References