CVE-2018-25429
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Paroiciel 11.20 contains an SQL injection vulnerability in the zProIdPro parameter. Authenticated attackers can send GET requests to zpro.php with crafted SQL payloads to extract sensitive database information, including usernames, databases, and version details.
Risk Assessment
An authenticated attacker can access sensitive data, including usernames and database structure, potentially leading to privilege escalation.
Recommendation
Update Paroiciel to a version that fixes the vulnerability and use parameterized SQL queries.
Other vulnerabilities in Paroiciel
See all- CVE-2018-25430High
Paroiciel 11.20 contains an SQL injection vulnerability in the eGeqIdEquipe parameter. Authenticated attackers can send GET requests to egeq.php with crafted SQL payloads to extract sensitive database information, including version details.
- CVE-2018-25428High
SQL Injection vulnerability in Paroiciel 11.20, allowing unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the tRecIdListe parameter. Attackers can send GET requests to trec.php.
Original NVD description (English source)
Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the zProIdPro parameter. Attackers can send GET requests to zpro.php with crafted SQL payloads in the zProIdPro parameter to extract sensitive database information including usernames, databases, and version details.