CVE-2018-25170: DoceboLMS SQL Injection Vulnerability

CVE-2018-25170 Overview

CVE-2018-25170 is a SQL Injection vulnerability affecting DoceboLMS 1.2, an open-source learning management system. The vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information, potentially compromising the entire database backend.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive database information, modify data, or potentially gain unauthorized access to the underlying system without any authentication requirements.

Affected Products

• DoceboLMS 1.2

Discovery Timeline

• 2026-03-06 - CVE CVE-2018-25170 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2018-25170

Vulnerability Analysis

This SQL injection vulnerability exists in the lesson.php endpoint of DoceboLMS 1.2. The application fails to properly sanitize user-supplied input in the id, idC, and idU parameters before incorporating them into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL statements that are executed by the database server with the same privileges as the application.

The vulnerability is particularly severe because it requires no authentication, meaning any remote attacker with network access can exploit it. A successful attack could lead to unauthorized disclosure of sensitive information stored in the database, including user credentials, personal information, course content, and administrative data.

Root Cause

The root cause of this vulnerability is improper input validation in the lesson.php file. The application directly uses user-supplied parameters (id, idC, idU) in database queries without implementing proper sanitization, parameterized queries, or prepared statements. This classic SQL injection pattern allows attackers to break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP GET requests to the lesson.php endpoint. An attacker constructs malicious payloads within the id, idC, or idU parameters to manipulate the SQL query logic. Since no authentication is required, the attack surface is exposed to any network-accessible threat actor.

The exploitation process involves identifying the vulnerable parameters, testing for SQL injection using common techniques (such as single quotes or boolean-based payloads), and then extracting database contents through error-based, time-based blind, or union-based SQL injection methods.

Technical details and proof-of-concept information can be found in the Exploit-DB #45858 entry and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2018-25170

Indicators of Compromise

• Unusual HTTP GET requests to lesson.php containing SQL syntax in the id, idC, or idU parameters
• Web server logs showing requests with encoded SQL characters such as %27 (single quote), %20OR%20, or UNION SELECT patterns
• Database error messages appearing in application responses or logs
• Unexpected database queries or query patterns in database logs

Detection Strategies

• Configure Web Application Firewalls (WAF) to detect and block SQL injection patterns in GET parameters targeting lesson.php
• Implement intrusion detection system (IDS) rules to alert on common SQL injection signatures in HTTP traffic
• Review web server access logs for suspicious requests containing SQL keywords or special characters in the affected parameters
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access attempts

Monitoring Recommendations

• Enable detailed logging on web servers and database servers to capture request parameters and query execution
• Set up real-time alerting for web application firewall rule triggers related to SQL injection
• Monitor for unusual database read operations or data exfiltration patterns
• Regularly audit access logs for requests targeting vulnerable endpoints with suspicious parameter values

How to Mitigate CVE-2018-25170

Immediate Actions Required

• Immediately restrict network access to DoceboLMS installations until patching or mitigation is complete
• Deploy Web Application Firewall rules to block SQL injection attempts targeting the lesson.php endpoint
• Review database and application logs for signs of prior exploitation
• Consider temporarily disabling the lesson.php functionality if operationally feasible

Patch Information

DoceboLMS 1.2 is a legacy version of the learning management system. Organizations should upgrade to a supported and patched version of the software. Consult the vendor documentation and the VulnCheck SQL Injection Advisory for the latest security recommendations and available patches.

Workarounds

• Implement strict input validation and sanitization at the web server or reverse proxy level for the id, idC, and idU parameters
• Deploy a Web Application Firewall configured with SQL injection protection rules
• Restrict access to the DoceboLMS application to trusted IP ranges only
• Apply the principle of least privilege to the database user account used by the application to minimize potential damage from successful exploitation

# Example WAF rule concept for blocking SQL injection patterns
# Add to your WAF or reverse proxy configuration

# ModSecurity rule example to block SQL injection in lesson.php parameters
SecRule ARGS:id|ARGS:idC|ARGS:idU "@detectSQLi" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt detected in lesson.php parameters'"