CVE-2018-25402 Overview
CVE-2018-25402 is a SQL injection vulnerability [CWE-89] in The Open ISES Project version 3.30A. The flaw resides in inc_types_graph.php, where the p1 GET parameter is passed to backend SQL queries without sanitization. Unauthenticated remote attackers can inject arbitrary SQL syntax to read database schemas, enumerate tables, and exfiltrate stored data. The vulnerability is reachable over the network without authentication or user interaction.
Critical Impact
Unauthenticated attackers can extract sensitive database contents from vulnerable Open ISES 3.30A deployments through a single crafted HTTP GET request.
Affected Products
- The Open ISES Project 3.30A
- Component: inc_types_graph.php
- Vulnerable parameter: p1 (GET)
Discovery Timeline
- 2026-05-29 - CVE-2018-25402 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2018-25402
Vulnerability Analysis
The vulnerability stems from unsafe concatenation of the p1 request parameter into a SQL statement inside inc_types_graph.php. The application accepts the parameter from a GET request and forwards it directly to the database driver. No prepared statements, parameter binding, or input validation routines intercept the value before execution.
Attackers can use union-based or error-based injection techniques to retrieve database metadata. The Exploit-DB entry #45645 documents a working payload that returns the current schema name through the response. Because the request method is GET, payloads can also be delivered through links, log poisoning, or referrer-driven attacks.
The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Open ISES is distributed as a PHP application, and the affected endpoint generates graph data without authentication, increasing the exposure of the underlying database engine.
Root Cause
The application builds dynamic SQL by concatenating the unvalidated p1 parameter into the query string. The codebase does not apply escaping, type casting, or parameterized queries. Combined with the absence of authentication on the graph endpoint, any visitor can submit arbitrary SQL fragments.
Attack Vector
The attack uses an HTTP GET request to inc_types_graph.php with a malicious p1 value. A typical exploitation pattern appends a UNION SELECT clause to leak schema names or column data. See the VulnCheck SQL Injection Advisory and Exploit-DB #45645 for the published proof of concept.
Detection Methods for CVE-2018-25402
Indicators of Compromise
- HTTP GET requests to inc_types_graph.php containing SQL keywords such as UNION, SELECT, INFORMATION_SCHEMA, or -- in the p1 parameter.
- Web server access logs showing URL-encoded SQL syntax (e.g., %20UNION%20SELECT) targeting the vulnerable endpoint.
- Unexpected database errors or abnormally large responses returned from inc_types_graph.php.
Detection Strategies
- Inspect web server and reverse proxy logs for query strings to inc_types_graph.php containing SQL metacharacters or boolean tautologies such as 1=1.
- Deploy web application firewall (WAF) rules tuned for union-based and error-based SQL injection patterns against the Open ISES URI path.
- Correlate spikes in database query volume or schema-enumeration queries (information_schema.tables, information_schema.columns) with HTTP requests to the affected endpoint.
Monitoring Recommendations
- Forward webserver, PHP error, and database audit logs to a centralized analytics platform for cross-source correlation.
- Alert on unauthenticated access patterns that issue repeated parameter mutations to inc_types_graph.php within short time windows.
- Baseline normal p1 parameter values and flag deviations that include SQL syntax or comment markers.
How to Mitigate CVE-2018-25402
Immediate Actions Required
- Restrict network access to Open ISES 3.30A installations, placing them behind authenticated reverse proxies or VPNs until remediated.
- Disable or remove inc_types_graph.php if the graph functionality is not required by the deployment.
- Deploy WAF signatures that block SQL metacharacters in the p1 parameter of requests to the affected endpoint.
Patch Information
No official vendor patch is referenced in the NVD entry for CVE-2018-25402. The Open ISES Project is hosted on SourceForge; administrators should consult the OpenISES Project Homepage and the OpenISES Download Page for any updated releases. Where no fixed version exists, organizations should evaluate replacing the application or applying source-level fixes that convert dynamic SQL in inc_types_graph.php to parameterized queries.
Workarounds
- Modify inc_types_graph.php to validate p1 against an allow-list of expected integer values and reject non-numeric input.
- Replace dynamic SQL concatenation with prepared statements using PDO or mysqli parameter binding.
- Place the application behind an authenticating gateway and restrict access by source IP to trusted operators.
# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /inc_types_graph.php" \
"chain,phase:2,deny,status:403,id:1002501,msg:'Block SQLi attempt on Open ISES p1 parameter'"
SecRule ARGS:p1 "@rx (?i)(union(\s|\+)+select|information_schema|--|/\*|;)" "t:none,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
