PT-2026-23701 · Unknown · Facturation System

CVE-2018-25191 · Publicado 2026-03-06 · Atualizado 2026-03-06

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Facturation System version 1.0

Description Facturation System version 1.0 contains an SQL injection issue that permits authenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the mod id parameter. Attackers can send POST requests to the ''editar producto.php'' endpoint with crafted SQL payloads in the mod id parameter to extract sensitive database information, including usernames, database names, and version details.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-25191

Produtos afetados

Facturation System

Referências · 4

• https://exploit-db.com/exploits/45813 · Nota
• https://t.me/CVEtracker/46606 · Publicação no Telegram
• https://vulncheck.com/advisories/facturation-system-sql-injection-via-editar-productophp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25191 · Nota de Segurança