CVE-2018-25194
SQL Injection in Nominas 0.27 Allows Database Data Extraction
Publication date: 2026-03-06
Last updated on: 2026-03-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "Nominas version 0.27 contains a SQL injection vulnerability in the 'username' parameter during the login process. This vulnerability exists in the PHP script at /login/checklogin.php, which processes POST requests for user authentication."}, {'type': 'paragraph', 'content': "An attacker can exploit this flaw by injecting malicious SQL code through the 'username' field, using UNION-based SQL injection payloads. This allows the attacker to execute arbitrary SQL queries on the database."}, {'type': 'paragraph', 'content': 'By exploiting this vulnerability, attackers can extract sensitive database information such as usernames, database names, and database version details without needing any authentication.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries on the Nominas database, potentially leading to unauthorized disclosure of sensitive information.
- Attackers can retrieve sensitive data such as usernames, database names, and database version details.
- The exposure of database details can facilitate further attacks against the system.
Because the attack requires no privileges or user interaction and has low attack complexity, it poses a high risk to the confidentiality of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending crafted POST requests to the login/checklogin.php endpoint with SQL injection payloads in the 'username' parameter and observing the response for database information leakage."}, {'type': 'paragraph', 'content': 'A typical test command using curl might look like this:'}, {'type': 'list_item', 'content': 'curl -X POST -d "username=\' UNION ALL SELECT 0x31,0x32,0x33,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())-- " -d "password=anything" http://targetsite/login/checklogin.php'}, {'type': 'paragraph', 'content': 'If the response contains database user, database name, or version information, it indicates the presence of the SQL injection vulnerability.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
I don't know