CVE-2018-25245
Published: 04 April 2026
Summary
CVE-2018-25245 is a high-severity Open Redirect (CWE-601) vulnerability in Microsoft (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2018-25245 is a denial-of-service vulnerability in the 7 Tik version 1.0.1.0 application, specifically affecting its search functionality. The issue arises from the application's failure to properly handle excessively long input strings, allowing a buffer of 7700 characters pasted into the search bar to trigger a crash. This flaw is classified under CWE-601 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its impact on availability.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By submitting a specially crafted long input string to the search bar, an attacker causes the application to crash, resulting in a denial of service for affected users. No privileges, confidentiality, or integrity impacts are possible.
Advisories and related resources, including an exploit on Exploit-DB (https://www.exploit-db.com/exploits/46197), the Microsoft Store product page (https://www.microsoft.com/store/productId/9NQL2QC8S935), and a VulnCheck advisory (https://www.vulncheck.com/advisories/7-tik-denial-of-service-via-search), provide details on the issue, though specific patch or mitigation guidance is not detailed in the available references. Security practitioners should verify updates for 7 Tik via the Microsoft Store.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21744
Vulnerability details
7 Tik 1.0.1.0 contains a denial of service vulnerability that allows attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 7700 characters into the search bar to trigger…
more
an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client application crash triggered by crafted long input to search functionality, directly enabling T1499.004 (Application or System Exploitation) for endpoint denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents the DoS by requiring validation of search inputs to reject excessively long strings like the 7700-character buffer that crashes the application.
SC-5 protects against denial-of-service events such as the application crash triggered by long search inputs from unauthenticated remote attackers.
SI-2 ensures timely remediation of the specific flaw in the 7 Tik search functionality that allows long inputs to cause crashes.