CVE-2018-25400: Open ISES Project SQL Injection Flaw

CVE-2018-25400 Overview

CVE-2018-25400 is a SQL injection vulnerability [CWE-89] in The Open ISES Project version 3.30A. The flaw resides in the ajax/form_post.php endpoint, which fails to sanitize the id parameter before passing it to backend SQL queries. Unauthenticated attackers can issue GET requests with crafted payloads to extract database schema details and arbitrary data. The vulnerability is reachable over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can extract sensitive database contents, including schema names and stored records, by injecting SQL through the id parameter of form_post.php.

Affected Products

The Open ISES Project 3.30A
Component: ajax/form_post.php
Distribution: OpenISes SourceForge release

Discovery Timeline

2026-05-29 - CVE-2018-25400 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25400

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP web application. The ajax/form_post.php script accepts an id parameter via HTTP GET and concatenates the supplied value into a SQL statement without parameterization or sanitization. An attacker can append SQL operators such as UNION SELECT to retrieve data from arbitrary tables.

Because the endpoint requires no authentication, exploitation is reachable from any client capable of issuing HTTP requests to the application. Successful exploitation discloses database structure and confidential records. The attacker does not need prior knowledge of credentials or session tokens.

The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A public proof-of-concept exists in Exploit-DB #45645 and the VulnCheck SQL Injection Advisory.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL query string. The application does not use prepared statements, parameter binding, or input validation against the id parameter. Any data placed in the parameter is interpreted as part of the SQL grammar.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a GET request to ajax/form_post.php with a malicious id value. Typical payloads use a UNION SELECT clause to enumerate tables and return rows such as information_schema.schemata. See the VulnCheck SQL Injection Advisory for payload structure and reproduction steps.

Detection Methods for CVE-2018-25400

Indicators of Compromise

HTTP GET requests to ajax/form_post.php containing SQL keywords such as UNION, SELECT, information_schema, or inline comments (--, /*).
Unusual outbound response sizes from form_post.php indicating data exfiltration.
Web server logs showing repeated requests to the endpoint from a single source within a short time window.

Detection Strategies

Inspect web server access logs for the id query parameter containing SQL metacharacters or encoded variants (%27, %20OR%20).
Deploy a web application firewall (WAF) rule set such as OWASP CRS to flag SQL injection signatures targeting PHP endpoints.
Correlate database error messages or schema enumeration queries with upstream HTTP requests to identify probe activity.

Monitoring Recommendations

Enable verbose query logging on the backend database to capture unexpected UNION or information_schema access.
Alert on anomalous HTTP 200 responses from form_post.php paired with large response bodies.
Monitor for scanner user-agents (sqlmap, nikto) targeting the OpenISes application path.

How to Mitigate CVE-2018-25400

Immediate Actions Required

Restrict network exposure of any OpenISes 3.30A deployment to trusted internal networks only.
Remove or disable the ajax/form_post.php endpoint if it is not required for production workflows.
Audit recent web and database logs for evidence of prior exploitation against the id parameter.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2018-25400. The Open ISES Project is hosted on SourceForge and appears unmaintained. Operators should consider migrating off the affected codebase. Refer to the OpenISes Project Overview and the OpenISes Latest Download page to verify the current release status before deploying any new instance.

Workarounds

Replace inline SQL concatenation with parameterized queries (PDO prepared statements) in ajax/form_post.php if source modifications are feasible.
Deploy a WAF rule that blocks SQL metacharacters in the id GET parameter for the affected path.
Enforce least-privilege database accounts so that the web application user cannot read information_schema or unrelated tables.

bash

# Example ModSecurity rule to block SQLi against form_post.php
SecRule REQUEST_URI "@contains /ajax/form_post.php" \
  "id:1002540,phase:2,deny,status:403,\
   chain,msg:'CVE-2018-25400 SQLi attempt'"
  SecRule ARGS:id "@detectSQLi" \
    "t:none,t:urlDecodeUni"