{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2018-25195", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-06T12:00:30.883Z", "datePublished": "2026-03-26T11:39:48.998Z", "dateUpdated": "2026-03-26T11:39:48.998Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-26T11:39:48.998Z"}, "datePublic": "2018-05-23T00:00:00.000Z", "title": "Wecodex Hotel CMS 1.0 SQL Injection via Admin Login", "descriptions": [{"lang": "en", "value": "Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php with action=processlogin to extract sensitive database information or gain unauthorized administrative access."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Wecodex", "product": "Wecodex Hotel CMS", "versions": [{"version": "1.0", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/44729", "name": "ExploitDB-44729", "tags": ["exploit"]}, {"url": "https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7", "name": "Official Product Homepage", "tags": ["product"]}, {"name": "VulnCheck Advisory: Wecodex Hotel CMS 1.0 SQL Injection via Admin Login", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login"}], "credits": [{"lang": "en", "value": "\u00d6zkan Mustafa Akku\u015f (AkkuS)", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php with action=processlogin to extract sensitive database information or gain unauthorized administrative access."}], "id": "CVE-2018-25195", "lastModified": "2026-03-26T15:13:15.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-03-26T12:16:04.467", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/44729"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login"}, {"source": "disclosure@vulncheck.com", "url": "https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Wecodex Hotel CMS", "source": "cna", "vendor": "Wecodex"}, "product": "wecodex_hotel_cms", "vendor": "wecodex"}], "analysis": {"en": {"generated_at": "2026-03-26T13:51:33.997269+00:00", "value": {"mitigation_remediation": ["Apply any vendor patch for Wecodex Hotel CMS 1.0", "If a patch is unavailable, restrict the login page to trusted IP ranges with a firewall or reverse proxy", "Implement input validation and parameterized queries in the login function to prevent SQL injection", "Disable detailed error messages on the login page to reduce information disclosure"], "summary": {"action": "Patch now", "impact": "Administrative access bypass"}, "threat_synthesis": {"affected_systems": "Only installations of Wecodex Hotel CMS version 1.0 are known to suffer from this vulnerability; no other versions are reported as affected.", "description_and_impact": "The login routine of Wecodex Hotel CMS 1.0 permits an attacker to inject arbitrary SQL code through the username field sent in a POST request to index.php?action=processlogin. This flaw allows unauthenticated users to bypass authentication, elevate privileges to the administrative interface, and potentially retrieve or modify sensitive data. The weakness aligns with the common SQL injection category identified by CWE-89.", "risk_and_exploitability": "The base CVSS score of 8.8 demonstrates a high\u2011severity risk. No EPSS score is available. Exploitation can occur remotely over the public web interface without any prior authentication and requires only network access to the server. Although it is not included in CISA's catalog of known exploited vulnerabilities, the attack could compromise confidentiality, integrity, and availability of the system."}}}}, "created": "2026-03-26T13:54:48.762599+00:00", "updated": "2026-03-27T08:36:10.348653+00:00", "vendors": ["wecodex", "wecodex$PRODUCT$wecodex_hotel_cms"]}