Back Nvd.Nist

CVE-2018-25183 Detail

Nvd.Nist • March 27, 2026

Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious SQL payloads using boolean-based blind techniques in POST requests to the admin login endpoint to authenticate without valid credentials.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerabilities Discovered in E-Commerce and CMS Platforms Two significant SQL injection vulnerabilities have been identified in widely used software. CVE-2018-25210 affects WebOfisi E-Ticaret 4.0, allowing unauthenticated attackers to manipulate database queries via the 'urun' GET parameter. Attackers can execute various SQL injection techniques, including boolean-based blind and error-based attacks. CVE-2018-25183 impacts Shipping System CMS 1.0, enabling attackers to bypass authentication by injecting SQL through the username parameter. This vulnerability allows unauthorized access to the admin login endpoint using malicious SQL payloads. Both vulnerabilities were published on March 26, 2026, and pose a significant risk to users of these platforms. Immediate action is recommended to mitigate potential exploitation. 2 sources 55

Extracted Entities

CVE-2018-25183 Detail

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)