CVE-2018-25201

HIGH

School Management System CMS 1.0 Admin Login SQL Injection

Title source: cna
STIX 2.1

Description

School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques to the processlogin endpoint to authenticate as administrator without valid credentials.

Exploits (1)

exploitdb WORKING POC
by AkkuS · textwebappsphp
https://www.exploit-db.com/exploits/44727

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-44727
https://www.exploit-db.com/exploits/44727
Third Party Advisory third-party-advisory
VulnCheck Advisory: School Management System CMS 1.0 Admin Login SQL Injection
https://www.vulncheck.com/advisories/school-management-system-cms-admin-login-sql-injection

Scores

CVSS v3 7.1
EPSS 0.0005
EPSS Percentile 14.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
wecodex/school_management_system_cms 1.0
Wecodex Solutions/School Management System CMS 1.0
Published Mar 26, 2026
Tracked Since Mar 26, 2026