CVE-2018-25210

HIGH

WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter

Title source: cna
STIX 2.1

Description

WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.

Exploits (1)

exploitdb WORKING POC
by AkkuS · textwebappsphp
https://www.exploit-db.com/exploits/45897

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-45897
https://www.exploit-db.com/exploits/45897
Product product
Official Product Homepage
https://www.web-ofisi.com
Third Party Advisory third-party-advisory
VulnCheck Advisory: WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter
https://www.vulncheck.com/advisories/webofisi-e-ticaret-sql-injection-via-urun-parameter

Scores

CVSS v3 8.2
EPSS 0.0010
EPSS Percentile 26.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
web-ofisi/e-ticaret < 4.0.0
Web-Ofisi/Ticaret V4 4.0
Published Mar 26, 2026
Tracked Since Mar 26, 2026