CVE-2018-25371
BaseFortify
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moosocial | store_plugin | 2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow attackers to extract sensitive database information without authentication. By exploiting the blind SQL injection, attackers can gain unauthorized access to confidential data, potentially leading to data breaches, loss of data integrity, and exposure of private information.
Can you explain this vulnerability to me?
The mooSocial Store Plugin version 2.6 contains a blind SQL injection vulnerability. This means that unauthenticated attackers can manipulate database queries by injecting SQL code through the product parameter in the URL rewrite functionality. The injection techniques include boolean-based blind, time-based blind, or stacked queries, allowing attackers to extract sensitive information from the database.