CVE-2018-25411: MGB OpenSource Guestbook SQLi Flaw

CVE-2018-25411 Overview

CVE-2018-25411 is a SQL injection vulnerability [CWE-89] in MGB OpenSource Guestbook version 0.7.0.2. The flaw resides in email.php, which fails to sanitize the id parameter before incorporating it into a SQL query. Unauthenticated remote attackers can send crafted GET requests to extract database contents, including table and column names. The vulnerability requires no authentication, no user interaction, and is exploitable over the network.

Critical Impact
Unauthenticated attackers can extract sensitive data from the backend database by injecting SQL payloads through the id parameter of email.php.

Affected Products

MGB OpenSource Guestbook 0.7.0.2
Distributed via the Mopzz-GB SourceForge project
Project homepage: M-GB Organization

Discovery Timeline

2026-05-30 - CVE-2018-25411 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2018-25411

Vulnerability Analysis

MGB OpenSource Guestbook 0.7.0.2 exposes a SQL injection flaw in the email.php endpoint. The script accepts the id parameter from user-supplied GET input and concatenates it directly into a SQL statement. Because the application performs no parameterization or input validation, attackers can break out of the query context and append arbitrary SQL clauses.

Exploitation does not require authentication or prior knowledge of application state. An attacker sends a single HTTP GET request with a crafted id value and receives query results reflected through the response. This enables enumeration of schemas, tables, and columns, followed by extraction of stored records.

The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A public proof of concept is published as Exploit-DB entry 45665, and additional technical analysis is available in the VulnCheck advisory.

Root Cause

The root cause is unsanitized concatenation of attacker-controlled input into a SQL query. The email.php script trusts the value of the id GET parameter and inserts it directly into a query string without prepared statements, type casting, or escaping. Any metacharacter the database interprets as SQL syntax is honored.

Attack Vector

The attack vector is network-based and requires only the ability to send HTTP requests to the guestbook application. An attacker issues a GET request to email.php with a payload appended to the id parameter, for example using UNION SELECT clauses to read arbitrary tables. No credentials, cookies, or user interaction are needed. See the Exploit-DB proof of concept for a documented request format.

Detection Methods for CVE-2018-25411

Indicators of Compromise

HTTP GET requests to email.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the id parameter.
Requests with URL-encoded SQL metacharacters (%27, %20OR%20, --) targeting /email.php?id=.
Abnormal database errors or unusually large response sizes from email.php.
Repeated requests from a single source iterating through numeric id values combined with conditional payloads.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns in query string parameters.
Enable verbose web server access logging and search for requests matching email.php?id= containing SQL syntax.
Correlate database query logs with web requests to identify malformed or unexpected queries originating from the guestbook component.

Monitoring Recommendations

Alert on outbound data spikes from the database tier following requests to legacy guestbook endpoints.
Monitor authentication tables and credential stores for unauthorized read access.
Track HTTP 500 responses and database error messages emitted by email.php as early indicators of probing.

How to Mitigate CVE-2018-25411

Immediate Actions Required

Take MGB OpenSource Guestbook 0.7.0.2 offline or restrict access to email.php until remediation is applied.
Review web server and database logs for prior exploitation attempts referencing the id parameter.
Rotate any credentials or secrets stored in the same database instance as the guestbook.

Patch Information

No vendor patch is referenced in the available advisory data. Organizations should consider migrating away from MGB OpenSource Guestbook 0.7.0.2 to an actively maintained guestbook or contact form solution. Consult the VulnCheck advisory for the latest remediation guidance.

Workarounds

Place the application behind a WAF with rules that block SQL injection patterns targeting the id parameter.
Apply a virtual patch to enforce integer-only validation on id at the reverse proxy or WAF layer.
Restrict the database account used by the guestbook to read-only access on the minimum required tables.
Remove or rename email.php if the feature is not in active use.

bash

# Example ModSecurity rule to block SQLi attempts against email.php
SecRule REQUEST_URI "@beginsWith /email.php" \
    "id:1002518,phase:2,deny,status:403,\
     chain,msg:'Block SQLi attempts on MGB Guestbook email.php (CVE-2018-25411)'"
    SecRule ARGS:id "@rx (?i)(union|select|sleep|information_schema|--|';)" \
        "t:none,t:urlDecodeUni"