What’s Vulnerable › Vulnerabilities

CVE-2018-25424: Gate Pass Management System 2.1 SQL Injection via login-exec.php

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-30 · updated 2026-07-22
• Weakness: CWE-89

Description

Gate Pass Management System 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login and password parameters. Attackers can submit crafted POST requests to login-exec.php with SQL injection payloads in form parameters to authenticate without valid credentials and gain access to the application.

Affected products

• Livebms Gate Pass Management System: 2.1

References

• http://www.livebms.com
• https://netcologne.dl.sourceforge.net/project/gatepass/gpms_Update.zip
• https://www.exploit-db.com/exploits/45766
• https://www.vulncheck.com/advisories/gate-pass-management-system-sql-injection-via-login-exec-php

Get alerted when CVE-2018-25424 or the next vulnerability affects your stack