CVE-2018-25300

HighPublic PoC

Published: 29 April 2026

Published

29 April 2026

Modified

30 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0032 24.1th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2018-25300 is a high-severity SQL Injection (CWE-89) vulnerability in Xataboost (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2018-25300 is a union-based SQL injection vulnerability (CWE-89) affecting XATABoost CMS version 1.0.0. The flaw resides in the news.php component, where the id parameter fails to properly sanitize user input, enabling attackers to inject arbitrary SQL code into database queries. This issue was published on 2026-04-29 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting its high severity due to network accessibility and lack of prerequisites.

Unauthenticated remote attackers can exploit the vulnerability by sending GET requests to news.php with malicious payloads in the id parameter. Exploitation allows manipulation of database queries to extract sensitive information, such as user credentials or other confidential data stored in the backend database, with high confidentiality impact and low integrity impact but no availability disruption.

Advisories and related resources, including a VulnCheck advisory at https://www.vulncheck.com/advisories/xataboost-cms-sql-injection-via-news-php and an Exploit-DB entry at https://www.exploit-db.com/exploits/44622, provide additional technical details. The vendor site at http://www2.xataboost.com may offer further context, though no specific patches are detailed in available information.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2018-21821

Vulnerability details

XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database…

information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Union-based SQL injection in publicly accessible news.php component directly enables remote exploitation of a web application without authentication, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0