CVE-2018-25206
Published: 26 March 2026
Summary
CVE-2018-25206 is a high-severity SQL Injection (CWE-89) vulnerability in Sitemakin (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-25206 is an SQL injection vulnerability (CWE-89) affecting KomSeo Cart version 1.3. The issue exists in the 'my_item_search' parameter of the edit.php component, where unsanitized user input allows attackers to inject arbitrary SQL commands into database queries. Published on 2026-03-26 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), it enables high-impact confidentiality breaches with low integrity disruption.
Unauthenticated remote attackers can exploit this vulnerability by submitting crafted POST requests containing malicious SQL payloads via the vulnerable parameter. Successful exploitation relies on boolean-based blind or error-based injection techniques to infer and extract sensitive database information, such as user credentials or other confidential data, without requiring user interaction or privileges.
Advisories and a proof-of-concept exploit are documented at sites including https://www.exploit-db.com/exploits/44753 and https://www.vulncheck.com/advisories/komseo-cart-sql-injection-via-edit-php, though specific patch or mitigation guidance is not detailed in the CVE information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21671
Vulnerability details
KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attackers can submit POST requests with malicious SQL payloads to extract sensitive database information using boolean-based blind or error-based…
more
injection techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (edit.php) directly enables remote unauthenticated exploitation (T1190) and extraction of database contents/credentials (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of unsanitized user input in the 'my_item_search' parameter before database query execution.
SI-2 mandates identification, reporting, and correction of the specific SQL injection flaw in edit.php to eliminate the vulnerability.
SI-11 mitigates error-based SQL injection by suppressing discernible error messages that reveal database information.