CVE-2018-25209

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2018-25209", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-26T11:34:46.382Z", "datePublished": "2026-03-26T11:39:55.703Z", "dateUpdated": "2026-03-26T18:25:23.772Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-26T11:39:55.703Z"}, "title": "OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter", "descriptions": [{"lang": "en", "value": "OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Sourceforge", "product": "OpenBiz Cubi Lite", "versions": [{"version": "v3.0.8", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/45801", "name": "ExploitDB-45801", "tags": ["exploit"]}, {"url": "https://sourceforge.net/projects/bigchef/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://sourceforge.net/projects/bigchef/files/latest/download", "name": "Product Reference", "tags": ["product"]}, {"name": "VulnCheck Advisory: OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/openbiz-cubi-lite-sql-injection-via-username-parameter"}], "credits": [{"lang": "en", "value": "\u00d6zkan Mustafa Akku\u015f (AkkuS)", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:19:00.960749Z", "id": "CVE-2018-25209", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:25:23.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-25209", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T18:19:00.960749Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:19:07.145Z"}}], "cna": {"title": "OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter", "credits": [{"lang": "en", "type": "finder", "value": "\u00d6zkan Mustafa Akku\u015f (AkkuS)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Sourceforge", "product": "OpenBiz Cubi Lite", "versions": [{"status": "affected", "version": "v3.0.8"}]}], "references": [{"url": "https://www.exploit-db.com/exploits/45801", "name": "ExploitDB-45801", "tags": ["exploit"]}, {"url": "https://sourceforge.net/projects/bigchef/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://sourceforge.net/projects/bigchef/files/latest/download", "name": "Product Reference", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/openbiz-cubi-lite-sql-injection-via-username-parameter", "name": "VulnCheck Advisory: OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-26T11:39:55.703Z"}}}, "cveMetadata": {"cveId": "CVE-2018-25209", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:25:23.772Z", "dateReserved": "2026-03-26T11:34:46.382Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-26T11:39:55.703Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenBiz Cubi Lite", "vendor": "Sourceforge", "versions": [{"status": "affected", "version": "v3.0.8"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication."}, {"lang": "es", "value": "OpenBiz Cubi Lite 3.0.8 contiene una vulnerabilidad de inyecci\u00f3n SQL en el formulario de inicio de sesi\u00f3n que permite a atacantes no autenticados manipular consultas de base de datos a trav\u00e9s del par\u00e1metro de nombre de usuario. Los atacantes pueden enviar solicitudes POST a /bin/controller.PHP con c\u00f3digo SQL malicioso en el campo de nombre de usuario para extraer informaci\u00f3n sensible de la base de datos o eludir la autenticaci\u00f3n."}], "id": "CVE-2018-25209", "lastModified": "2026-06-17T01:54:57.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-25209", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:19:00.960749Z", "version": "2.0.3"}}]}, "published": "2026-03-26T12:16:06.257", "references": [{"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/projects/bigchef/"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/projects/bigchef/files/latest/download"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/45801"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openbiz-cubi-lite-sql-injection-via-username-parameter"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "v3.0.8"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OpenBiz Cubi Lite", "source": "cna", "vendor": "Sourceforge"}, "product": "openbiz_cubi_lite", "vendor": "sourceforge"}], "analysis": {"en": {"generated_at": "2026-03-26T13:21:41.536457+00:00", "value": {"mitigation_remediation": ["Apply an available patch or upgrade to a newer OpenBiz Cubi Lite release that resolves the injection flaw.", "Restrict direct POST access to the controller endpoint by configuring a web\u2011application firewall or network firewall to allow traffic only from trusted IP ranges.", "Deploy a web\u2011application firewall rule that blocks suspicious SQL syntax in the username field.", "Continuously monitor authentication and database logs for anomalous activity.", "Verify with the SourceForge project page or vendor documentation that the affected version has been fixed before restoring normal access."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated SQL Injection leading to data exposure or authentication bypass"}, "threat_synthesis": {"affected_systems": "This flaw affects Sourceforge's OpenBiz Cubi Lite product, specifically version 3.0.8. Only this version is known to be affected according to the available CNA data.", "description_and_impact": "The vulnerability resides in a login form that processes user input without proper sanitization. An unauthenticated attacker can submit a crafted POST request to the controller endpoint, inserting SQL commands in the username field. This flaw permits execution of arbitrary database queries, allowing the attacker to read, modify, or delete sensitive data, or to bypass authentication entirely. The weakness aligns with CWE\u201189, leading to potential loss of confidentiality and integrity of the application database.", "risk_and_exploitability": "The vulnerability is rated high with a CVSS score of 8.8, indicating a severe impact when exploited. Although EPSS data is unavailable, the absence from the KEV catalog does not mitigate the threat, as the flaw allows unauthenticated data access over the network. Attackers can exploit the flaw remotely via the public web interface, requiring no credentials. Due to the straightforward nature of the injection and the lack of authentication, the barrier to exploitation is low."}}}}, "created": "2026-03-26T13:54:41.548784+00:00", "updated": "2026-03-27T08:36:01.868675+00:00", "vendors": ["sourceforge", "sourceforge$PRODUCT$openbiz_cubi_lite"]}