CVE-2018-25182
SQL Injection in Silurus Classifieds 2.0 Allows Data Extraction
Publication date: 2026-03-06
Last updated on: 2026-03-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| silurus | silurus_classifieds_script | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "The Silurus Classifieds Script 2.0 contains an SQL injection vulnerability in the 'ID' parameter of the wcategory.php endpoint. This flaw allows unauthenticated attackers to inject malicious SQL code through the URL parameter, manipulating the underlying SQL queries executed by the application."}, {'type': 'paragraph', 'content': 'By sending specially crafted GET requests with SQL payloads, attackers can extract sensitive information such as database table names and other data from the database schema.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive data stored in the database by allowing attackers to execute arbitrary SQL queries.
Attackers can extract database schema information and potentially other confidential data, which may result in further compromise of the web application and its data integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending crafted GET requests to the vulnerable endpoint and observing the response for SQL injection behavior.'}, {'type': 'paragraph', 'content': "Specifically, you can test the 'ID' parameter in the URL /wcategory.php by injecting SQL payloads such as UNION SELECT statements to check if the application returns database schema information."}, {'type': 'paragraph', 'content': 'An example command using curl to test this vulnerability is:'}, {'type': 'list_item', 'content': 'curl "http://targetsite.com/wcategory.php?ID=1+UNION+SELECT+1,table_name,3,4+FROM+INFORMATION_SCHEMA.TABLES--"'}, {'type': 'paragraph', 'content': 'If the response contains database table names or other unexpected data, it indicates the presence of the SQL injection vulnerability.'}] [1]