CVE-2018-25199: OOP CMS BLOG 1.0 SQL Injection via search parameter

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-06 · updated 2026-06-17
Weakness: CWE-89

Description

OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through multiple parameters. Attackers can inject SQL commands via the search parameter in search.php, pageid parameter in page.php, and id parameter in posts.php to extract database information including table names, schema names, and database credentials.

Affected products

Zsoft OOP CMS BLOG: 1.0

References

https://www.exploit-db.com/exploits/45799
https://www.vulncheck.com/advisories/oop-cms-blog-sql-injection-via-search-parameter

Get alerted when CVE-2018-25199 or the next vulnerability affects your stack