CVE-2018-25403 | THREATINT

Description

The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the p1 parameter. Attackers can send GET requests to city_graph.php with crafted SQL payloads to extract sensitive database information including schema names and other data.

PUBLISHED Reserved 2026-05-29 | Published 2026-05-29 | Updated 2026-05-29 | Assigner VulnCheck

HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

3.30A

affected

Credits

Ihsan Sencan finder

References

www.exploit-db.com/exploits/45645 (ExploitDB-45645) exploit

openises.sourceforge.net/ (Official Product Homepage) product

sourceforge.net/projects/openises/files/latest/download (Product Reference) product

www.vulncheck.com/...-3-30a-sql-injection-via-city-graph-php (VulnCheck Advisory: The Open ISES Project 3.30A SQL Injection via city_graph.php) third-party-advisory

cve.org (CVE-2018-25403)

nvd.nist.gov (CVE-2018-25403)

Download JSON