CVE-2018-25208
Published: 26 March 2026
Summary
CVE-2018-25208 is a high-severity SQL Injection (CWE-89) vulnerability in Qdpm (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2018-25208 is an SQL injection vulnerability (CWE-89) affecting qdPM version 9.1, a project management software. The flaw resides in the timeReport endpoint, where the filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters fail to properly sanitize user input, allowing attackers to inject and execute arbitrary SQL code. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with network accessibility and no authentication requirements.
Unauthenticated attackers can exploit this vulnerability remotely by submitting malicious POST requests to the timeReport endpoint with crafted filter_by parameters. Successful exploitation enables extraction of database information, execution of arbitrary SQL queries, and retrieval of sensitive data from the underlying database.
Advisories and related resources, including an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/45767) and a detailed advisory from VulnCheck (https://www.vulncheck.com/advisories/qdpm-sql-injection-via-filter-by-parameters), document the issue. The official qdPM website (http://qdpm.net and http://qdpm.net/download-qdpm-free-project-management) provides context on the software, though specific patch details are not outlined in the available references. Security practitioners should review these for mitigation guidance and upgrade to patched versions if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21675
Vulnerability details
qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute…
more
arbitrary SQL queries and retrieve sensitive data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated SQL injection in a public-facing web app (timeReport endpoint) matches T1190 exactly; enables arbitrary query execution and data extraction from the backend database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires implementation of input validation mechanisms at the timeReport endpoint to sanitize filter_by parameters and directly prevent SQL injection exploitation.
Mandates identification, reporting, and correction of the specific SQL injection flaw in CVE-2018-25208 through timely patching or code remediation.
Enables regular vulnerability scanning to identify the SQL injection vulnerability in qdPM 9.1 timeReport endpoint prior to exploitation.