Back Nvd.Nist

CVE-2018-25210 Detail

Nvd.Nist • March 27, 2026

WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerabilities Discovered in E-Commerce and CMS Platforms Two significant SQL injection vulnerabilities have been identified in widely used software. CVE-2018-25210 affects WebOfisi E-Ticaret 4.0, allowing unauthenticated attackers to manipulate database queries via the 'urun' GET parameter. Attackers can execute various SQL injection techniques, including boolean-based blind and error-based attacks. CVE-2018-25183 impacts Shipping System CMS 1.0, enabling attackers to bypass authentication by injecting SQL through the username parameter. This vulnerability allows unauthorized access to the admin login endpoint using malicious SQL payloads. Both vulnerabilities were published on March 26, 2026, and pose a significant risk to users of these platforms. Immediate action is recommended to mitigate potential exploitation. 2 sources 55

Extracted Entities

Attack Types (1)

Sql Injection

CVEs (1)

CVE-2018-25210