CVE-2018-25399: Open ISES Project SQL Injection Flaw

CVE-2018-25399 Overview

CVE-2018-25399 is an SQL injection vulnerability in The Open ISES Project version 3.30A. The flaw resides in the nearby.php script, which fails to sanitize the tick_lat and tick_lng GET parameters before passing them into SQL queries. Unauthenticated remote attackers can inject arbitrary SQL syntax and read sensitive database contents, including usernames, database names, and version metadata. The weakness is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A working proof-of-concept is published at Exploit-DB #45645.

Critical Impact
Unauthenticated attackers can extract database contents over the network through crafted GET requests to nearby.php, with no user interaction required.

Affected Products

The Open ISES Project 3.30A
nearby.php endpoint shipped with OpenISES
Deployments distributed via the OpenISES SourceForge project

Discovery Timeline

2026-05-29 - CVE-2018-25399 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25399

Vulnerability Analysis

The vulnerability is a classic first-order SQL injection in a public-facing PHP endpoint. The nearby.php script accepts geographic coordinates through the tick_lat and tick_lng query string parameters. These values are concatenated into an SQL statement without parameterization or input validation. An attacker can break out of the intended numeric context and append arbitrary clauses such as UNION SELECT to retrieve data from any table the database user can read.

Because the endpoint requires no authentication and the request method is GET, exploitation can be automated with simple HTTP clients. The VulnCheck advisory confirms that information such as user(), database(), and version() can be exfiltrated through standard union-based extraction techniques.

Root Cause

The root cause is missing input neutralization in the SQL query construction logic of nearby.php. The application trusts client-supplied coordinate parameters and does not enforce numeric typing, escaping, or prepared statements. Any character permitted by the HTTP layer reaches the SQL parser unchanged.

Attack Vector

The attack is launched remotely over HTTP. An attacker issues a GET request to nearby.php with malicious SQL payloads inside the tick_lat or tick_lng query parameters. The injected SQL executes inside the application's database context, returning data in the HTTP response or via inferential techniques. No credentials, session, or user interaction are required.

A representative request pattern, described in the public Exploit-DB entry, places a union-based payload into the latitude or longitude parameter to surface the current database user, schema name, and server version. See Exploit-DB #45645 for the published proof-of-concept payloads.

Detection Methods for CVE-2018-25399

Indicators of Compromise

HTTP GET requests to nearby.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the tick_lat or tick_lng parameters.
URL-encoded SQL metacharacters (%27, %23, --, %20OR%20) in query strings targeting OpenISES endpoints.
Web server access log entries showing abnormally long query strings or repeated parameter probing against nearby.php.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL syntax in numeric coordinate parameters.
Inspect database query logs for unexpected UNION SELECT statements originating from the OpenISES application user.
Correlate HTTP request logs with database error events to identify probing activity against nearby.php.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation and retention.
Alert on anomalous spikes in 200-status responses with large payload sizes from nearby.php.
Track outbound data volume from the database host to detect bulk extraction.

How to Mitigate CVE-2018-25399

Immediate Actions Required

Restrict public access to nearby.php until the underlying SQL query is parameterized.
Place the application behind a WAF configured to block SQL injection patterns in GET parameters.
Audit the database account used by OpenISES and reduce its privileges to the minimum required.
Review historical web and database logs for evidence of prior exploitation.

Patch Information

No official vendor patch is referenced in the available advisories. OpenISES is distributed through the OpenISES SourceForge project page; administrators should check the project repository for newer releases or apply source-level fixes that replace string concatenation with prepared statements. Refer to the VulnCheck advisory for the latest remediation guidance.

Workarounds

Enforce server-side validation that rejects any value in tick_lat or tick_lng that is not a valid floating-point number.
Replace dynamic SQL in nearby.php with parameterized queries or PDO prepared statements.
Block requests to nearby.php at the reverse proxy when the application is not actively used.
Run the database service under a dedicated low-privilege account that cannot read sensitive schemas.

bash

# Example WAF rule (ModSecurity) blocking SQL keywords in nearby.php parameters
SecRule REQUEST_URI "@beginsWith /nearby.php" \
    "chain,phase:2,deny,status:403,id:1002599,msg:'CVE-2018-25399 SQLi attempt'"
    SecRule ARGS:tick_lat|ARGS:tick_lng "@rx (?i)(union|select|sleep\(|information_schema|--|/\*)" \
        "t:none,t:urlDecodeUni"