CVE-2018-25401 Overview
CVE-2018-25401 is a SQL injection vulnerability [CWE-89] in The Open-ISES Project version 3.30A. The flaw resides in the sever_graph.php script, which fails to sanitize the p1 GET parameter before passing it to backend database queries. Unauthenticated remote attackers can inject arbitrary SQL statements through this parameter to read database schema names and exfiltrate stored data. No authentication or user interaction is required to exploit the issue.
Critical Impact
Unauthenticated attackers can extract sensitive database content from Open-ISES 3.30A deployments by sending crafted GET requests to sever_graph.php.
Affected Products
- The Open-ISES Project 3.30A
- Deployments exposing sever_graph.php over the network
- Distributions sourced from the Open-ISES SourceForge package
Discovery Timeline
- 2026-05-29 - CVE-2018-25401 published to the National Vulnerability Database
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2018-25401
Vulnerability Analysis
The vulnerability is a classic SQL injection [CWE-89] in the sever_graph.php endpoint of Open-ISES 3.30A. The script accepts user input through the p1 query string parameter and concatenates that value directly into a SQL statement. Because the application performs no parameterization or input validation, attackers can break out of the intended query context and append arbitrary SQL clauses.
Publicly available exploitation material, including Exploit-DB #45645 and the VulnCheck SQL Injection Advisory, demonstrates extraction of database schema information through UNION SELECT payloads delivered in the p1 parameter.
Root Cause
The root cause is unsanitized user input incorporated into a dynamically constructed SQL query. The sever_graph.php handler trusts the p1 GET parameter and concatenates it into the query string sent to the database engine. The application does not use prepared statements, parameter binding, or allow-list validation, which would prevent attacker-controlled syntax from altering the query.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP GET request to sever_graph.php with a malicious SQL payload appended to the p1 parameter. The injected statement executes with the privileges of the database user configured for the application, enabling enumeration of database schemas, tables, and stored records. See the VulnCheck SQL Injection Advisory for a full request example.
Detection Methods for CVE-2018-25401
Indicators of Compromise
- HTTP GET requests to sever_graph.php containing SQL keywords such as UNION, SELECT, INFORMATION_SCHEMA, or -- in the p1 parameter.
- Web server logs showing abnormally long or URL-encoded values for the p1 query string parameter.
- Database error messages or 500 responses generated by sever_graph.php during reconnaissance attempts.
Detection Strategies
- Deploy web application firewall rules that flag SQL metacharacters and UNION-based payloads targeting sever_graph.php.
- Correlate web access logs with database query logs to identify queries originating from the Open-ISES application that reference system schema objects.
- Hunt for repeated requests to the same endpoint with incrementally modified p1 values, a pattern typical of SQL injection automation tools.
Monitoring Recommendations
- Enable verbose access logging on any web server hosting Open-ISES 3.30A and forward logs to a centralized analytics platform.
- Alert on unauthenticated requests to sever_graph.php that return non-standard response sizes or status codes.
- Monitor the application's database account for queries against information_schema tables, which legitimate application logic should not require.
How to Mitigate CVE-2018-25401
Immediate Actions Required
- Restrict network access to Open-ISES 3.30A so that sever_graph.php is not reachable from untrusted networks.
- Deploy a web application firewall rule blocking SQL injection patterns in the p1 parameter until a code fix is applied.
- Audit the application's database account permissions and revoke any privileges beyond what the application strictly requires.
Patch Information
No vendor patch is referenced in the NVD entry for CVE-2018-25401. The Open-ISES project is distributed through SourceForge, and administrators should verify on the Open-ISES Project Homepage whether a newer release addresses the issue. If no fix is available, modify sever_graph.php locally to use parameterized queries or strict integer validation on p1.
Workarounds
- Replace direct concatenation of $_GET['p1'] with a prepared statement using bound parameters before passing the value to the database driver.
- If p1 is expected to be numeric, cast it with intval() or validate it against a strict regular expression prior to use.
- Place the application behind an authenticated reverse proxy to remove unauthenticated network exposure of sever_graph.php.
# Example WAF rule (ModSecurity) blocking SQL injection on the p1 parameter
SecRule ARGS:p1 "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|--|;|\bor\b\s+\d+=\d+)" \
"id:1002501,phase:2,deny,status:403,log,msg:'CVE-2018-25401 SQLi attempt on sever_graph.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
