PT-2026-23675 · Undefined · Undefined

CVE-2018-25163 · Publicado 2026-03-06 · Atualizado 2026-03-06

NVD

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-25163

Produtos afetados

Undefined

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-25163 · Nota de Segurança
• https://vulncheck.com/advisories/bitzoom-sql-injection-via-rollno-parameter · Nota
• https://exploit-db.com/exploits/45862 · Nota