CVE-2018-25403: Open ISES Project SQLi Vulnerability

CVE-2018-25403 Overview

CVE-2018-25403 is a SQL injection vulnerability in The Open ISES Project version 3.30A. The flaw resides in the city_graph.php script, which fails to sanitize the p1 GET parameter before incorporating it into a SQL query. Unauthenticated remote attackers can inject arbitrary SQL through crafted HTTP requests. Successful exploitation exposes database schema details and sensitive records stored by the application. The weakness is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can read arbitrary database contents over the network by sending a single crafted GET request to city_graph.php.

Affected Products

The Open ISES Project 3.30A
Distributions hosted on the OpenISES SourceForge repository
Deployments exposing city_graph.php over HTTP

Discovery Timeline

2026-05-29 - CVE-2018-25403 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25403

Vulnerability Analysis

The Open ISES Project 3.30A ships a PHP component, city_graph.php, that constructs SQL statements using the p1 query string parameter without parameterized queries or input filtering. An attacker supplying SQL meta-characters in p1 alters the structure of the executed query. The result is a classic in-band SQL injection that returns database content within the HTTP response. The attack requires no authentication, no user interaction, and only network reachability to the web application.

The vulnerability falls under [CWE-89] and the publicly available exploit at Exploit-DB #45645 demonstrates extraction of schema metadata such as database and table names. EPSS data places the probability of observed exploitation at 0.09%.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL statement inside city_graph.php. The script does not use prepared statements, type casting, or allow-list validation for the p1 parameter. Any string supplied by the requester reaches the database driver verbatim. This pattern allows boolean-based, UNION-based, and error-based injection techniques against the underlying database.

Attack Vector

The attack vector is a remote HTTP GET request targeting city_graph.php?p1=<payload>. The attacker appends SQL clauses such as UNION SELECT statements to enumerate schemas, tables, columns, and rows. Because the endpoint is unauthenticated, automated scanners can identify and exploit vulnerable instances at scale. Refer to the VulnCheck Advisory on OpenISES SQL Injection for the request structure and exploitation technique.

No verified code example is available; consult the linked advisory and Exploit-DB entry for payload specifics.

Detection Methods for CVE-2018-25403

Indicators of Compromise

HTTP GET requests to /city_graph.php containing SQL keywords such as UNION, SELECT, INFORMATION_SCHEMA, or -- inside the p1 parameter.
Web server access logs showing abnormally long or URL-encoded p1 values from a single source.
Database error messages or extended response times tied to requests against city_graph.php.
Unexpected outbound data flows from the database host following requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall signatures that flag SQL meta-characters in the p1 query parameter.
Enable database query auditing to capture statements originating from the OpenISES service account.
Correlate web access logs with database logs to detect injected UNION-based payloads.
Hunt for repeated 200-status responses to city_graph.php with unusually large response bodies.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
Alert on any access to city_graph.php from external IP ranges if the application is intended for internal use only.
Track schema enumeration patterns by monitoring queries that reference information_schema.tables or information_schema.columns.

How to Mitigate CVE-2018-25403

Immediate Actions Required

Remove or restrict network access to city_graph.php until a fix is applied.
Place the application behind a web application firewall with SQL injection rules tuned for the p1 parameter.
Rotate database credentials used by the OpenISES application and restrict its account to least privilege.
Audit database logs for prior exploitation attempts referencing city_graph.php.

Patch Information

No vendor patch is referenced in the NVD record. The Open ISES Project is hosted on SourceForge; review the OpenISES Project Homepage and OpenISES Latest Download for any community-supplied updates. Until an official fix is available, treat the application as unsupported and apply compensating controls.

Workarounds

Rewrite city_graph.php to use parameterized queries or PDO prepared statements for the p1 value.
Apply server-side allow-list validation that accepts only the expected numeric or alphanumeric format for p1.
Configure the database user with read-only access to required tables and deny access to information_schema where feasible.
Block direct internet exposure of the application and require VPN or authenticated reverse proxy access.

bash

# Example WAF rule (ModSecurity) blocking SQLi in the p1 parameter
SecRule ARGS:p1 "@detectSQLi" \
    "id:1002503,phase:2,deny,status:403,log,\
    msg:'CVE-2018-25403 OpenISES city_graph.php SQLi attempt'"