CVE-2018-25430
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Paroiciel 11.20 contains an SQL injection vulnerability in the eGeqIdEquipe parameter. Authenticated attackers can send GET requests to egeq.php with crafted SQL payloads to extract sensitive database information, including version details.
Risk Assessment
An authenticated attacker can obtain database version information and other sensitive data, which may facilitate further attacks.
Recommendation
Update Paroiciel to a version that fixes the vulnerability and use parameterized SQL queries.
Other vulnerabilities in Paroiciel
See all- CVE-2018-25429High
Paroiciel 11.20 contains an SQL injection vulnerability in the zProIdPro parameter. Authenticated attackers can send GET requests to zpro.php with crafted SQL payloads to extract sensitive database information, including usernames, databases, and version details.
- CVE-2018-25428High
SQL Injection vulnerability in Paroiciel 11.20, allowing unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the tRecIdListe parameter. Attackers can send GET requests to trec.php.
Original NVD description (English source)
Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the eGeqIdEquipe parameter. Attackers can send GET requests to the egeq.php endpoint with crafted SQL payloads to extract sensitive database information including version details and other data.