CVE-2018-18822

CRITICAL

Grapixel New Media v2.0 - SQL Injection via pages.aspx pageref Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-18822. PoCs published by Berk Dusunur.

AI-analyzed exploit summary This exploit demonstrates a time-based blind SQL injection vulnerability in Grapixel New Media 2 via the 'pageref' parameter. The PoC includes payloads to trigger delays and extract database information by observing response times.

Description

Grapixel New Media v2.0 allows SQL Injection via the pages.aspx pageref parameter.

Exploits (1)

exploitdb WORKING POC
by Berk Dusunur · textwebappsphp
https://www.exploit-db.com/exploits/45704

This exploit demonstrates a time-based blind SQL injection vulnerability in Grapixel New Media 2 via the 'pageref' parameter. The PoC includes payloads to trigger delays and extract database information by observing response times.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Grapixel New Media v2
No auth needed
Prerequisites: Access to the vulnerable web application
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45704/

Scores

CVSS v3 9.8
EPSS 0.0159
EPSS Percentile 72.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
grapixel/new_media 2.0
Published Oct 30, 2018
Tracked Since Feb 18, 2026