CVE-2018-25183

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-25183
Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious SQL payloads using boolean-based blind techniques in POST requests to the admin login endpoint to authenticate without valid credentials.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/44722 Exploit VDB Entry
https://www.vulncheck.com/advisories/shipping-system-cms-sql-injection-via-admin-login Third Party Advisory
https://www.wecodex.com/item/view/shipping-system-by-parcel-in-php-and-mysql/4 Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:wecodex:shipping_system_cms:1.0:*:*:*:*:*:*:*
History

27 Mar 2026, 18:15

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/44722 - () https://www.exploit-db.com/exploits/44722 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/shipping-system-cms-sql-injection-via-admin-login - () https://www.vulncheck.com/advisories/shipping-system-cms-sql-injection-via-admin-login - Third Party Advisory
References () https://www.wecodex.com/item/view/shipping-system-by-parcel-in-php-and-mysql/4 - () https://www.wecodex.com/item/view/shipping-system-by-parcel-in-php-and-mysql/4 - Broken Link
Summary
  • (es) El Sistema de Envío CMS 1.0 contiene una vulnerabilidad de inyección SQL que permite a atacantes no autenticados eludir la autenticación inyectando código SQL a través del parámetro de nombre de usuario. Los atacantes pueden enviar cargas útiles SQL maliciosas utilizando técnicas ciegas basadas en booleanos en solicitudes POST al endpoint de inicio de sesión de administrador para autenticarse sin credenciales válidas.
First Time Wecodex shipping System Cms
Wecodex
CPE cpe:2.3:a:wecodex:shipping_system_cms:1.0:*:*:*:*:*:*:*

26 Mar 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-26 12:16

Updated : 2026-03-27 18:15

NVD link : CVE-2018-25183

Mitre link : CVE-2018-25183

CVE.ORG link : CVE-2018-25183

JSON object : View

Products Affected

wecodex

  • shipping_system_cms
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')