CVE-2018-25183
HIGHShipping System CMS 1.0 SQL Injection via admin login
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25183. PoCs published by AkkuS.
AI-analyzed exploit summary This exploit demonstrates a boolean-based blind SQL injection vulnerability in Shipping System CMS 1.0 via the 'username' POST parameter during login. The payload uses MySQL RLIKE to bypass authentication by manipulating the query logic.
Description
Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious SQL payloads using boolean-based blind techniques in POST requests to the admin login endpoint to authenticate without valid credentials.
Exploits (1)
This exploit demonstrates a boolean-based blind SQL injection vulnerability in Shipping System CMS 1.0 via the 'username' POST parameter during login. The payload uses MySQL RLIKE to bypass authentication by manipulating the query logic.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N