CVE-2018-25205
Published: 26 March 2026
Summary
CVE-2018-25205 is a high-severity SQL Injection (CWE-89) vulnerability in Mediasoftpro (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2018-25205 is an SQL injection vulnerability (CWE-89) affecting ASP.NET jVideo Kit 1.0. The flaw resides in the search functionality, where the 'query' parameter enables attackers to inject SQL commands via GET or POST requests to the /search endpoint. Published on 2026-03-26, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with low attack complexity.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By submitting malicious SQL payloads, they can extract sensitive database information using boolean-based blind or error-based techniques, potentially compromising data such as user credentials or other stored content.
Advisories and references, including Exploit-DB (https://www.exploit-db.com/exploits/44739), the vendor page (https://www.mediasoftpro.com/video-sharing-script/mvc/), and Vulncheck (https://www.vulncheck.com/advisories/asp-net-jvideo-kit-sql-injection-via-query-parameter), provide further details on the issue, though specific patch or mitigation guidance is not detailed in the CVE description. Security practitioners should review these for remediation steps, such as input sanitization or upgrading the software.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21669
Vulnerability details
ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint…
more
to extract sensitive database information using boolean-based blind or error-based techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/search endpoint) enables unauthenticated remote exploitation (T1190) to extract sensitive database information including credentials (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'query' parameter to block malicious SQL payloads and prevent SQL injection exploitation.
Enforces error handling that suppresses database error details, mitigating error-based SQL injection techniques used to extract sensitive information.
Imposes restrictions on information inputs like the 'query' parameter to limit payload size, characters, or types that enable SQL injection.