CVE-2018-25170: DoceboLMS SQL Injection Vulnerability

CVE-2018-25170 Overview

CVE-2018-25170 is a SQL Injection vulnerability affecting DoceboLMS 1.2, an open-source learning management system. The vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information, potentially compromising the entire database backend.

Critical Impact
Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive database information, modify data, or potentially gain unauthorized access to the underlying system without any authentication requirements.

Affected Products

DoceboLMS 1.2

Discovery Timeline

2026-03-06 - CVE CVE-2018-25170 published to NVD
2026-03-09 - Last updated in NVD database

Technical Details for CVE-2018-25170

Vulnerability Analysis

This SQL injection vulnerability exists in the lesson.php endpoint of DoceboLMS 1.2. The application fails to properly sanitize user-supplied input in the id, idC, and idU parameters before incorporating them into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL statements that are executed by the database server with the same privileges as the application.

The vulnerability is particularly severe because it requires no authentication, meaning any remote attacker with network access can exploit it. A successful attack could lead to unauthorized disclosure of sensitive information stored in the database, including user credentials, personal information, course content, and administrative data.

Root Cause

The root cause of this vulnerability is improper input validation in the lesson.php file. The application directly uses user-supplied parameters (id, idC, idU) in database queries without implementing proper sanitization, parameterized queries, or prepared statements. This classic SQL injection pattern allows attackers to break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP GET requests to the lesson.php endpoint. An attacker constructs malicious payloads within the id, idC, or idU parameters to manipulate the SQL query logic. Since no authentication is required, the attack surface is exposed to any network-accessible threat actor.

The exploitation process involves identifying the vulnerable parameters, testing for SQL injection using common techniques (such as single quotes or boolean-based payloads), and then extracting database contents through error-based, time-based blind, or union-based SQL injection methods.

Technical details and proof-of-concept information can be found in the Exploit-DB #45858 entry and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2018-25170

Indicators of Compromise

Unusual HTTP GET requests to lesson.php containing SQL syntax in the id, idC, or idU parameters
Web server logs showing requests with encoded SQL characters such as %27 (single quote), %20OR%20, or UNION SELECT patterns
Database error messages appearing in application responses or logs
Unexpected database queries or query patterns in database logs

Detection Strategies

Configure Web Application Firewalls (WAF) to detect and block SQL injection patterns in GET parameters targeting lesson.php
Implement intrusion detection system (IDS) rules to alert on common SQL injection signatures in HTTP traffic
Review web server access logs for suspicious requests containing SQL keywords or special characters in the affected parameters
Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access attempts

Monitoring Recommendations

Enable detailed logging on web servers and database servers to capture request parameters and query execution
Set up real-time alerting for web application firewall rule triggers related to SQL injection
Monitor for unusual database read operations or data exfiltration patterns
Regularly audit access logs for requests targeting vulnerable endpoints with suspicious parameter values

How to Mitigate CVE-2018-25170

Immediate Actions Required

Immediately restrict network access to DoceboLMS installations until patching or mitigation is complete
Deploy Web Application Firewall rules to block SQL injection attempts targeting the lesson.php endpoint
Review database and application logs for signs of prior exploitation
Consider temporarily disabling the lesson.php functionality if operationally feasible

Patch Information

DoceboLMS 1.2 is a legacy version of the learning management system. Organizations should upgrade to a supported and patched version of the software. Consult the vendor documentation and the VulnCheck SQL Injection Advisory for the latest security recommendations and available patches.

Workarounds

Implement strict input validation and sanitization at the web server or reverse proxy level for the id, idC, and idU parameters
Deploy a Web Application Firewall configured with SQL injection protection rules
Restrict access to the DoceboLMS application to trusted IP ranges only
Apply the principle of least privilege to the database user account used by the application to minimize potential damage from successful exploitation

bash

# Example WAF rule concept for blocking SQL injection patterns
# Add to your WAF or reverse proxy configuration

# ModSecurity rule example to block SQL injection in lesson.php parameters
SecRule ARGS:id|ARGS:idC|ARGS:idU "@detectSQLi" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt detected in lesson.php parameters'"