CVE-2018-25425: Yot CMS 3.3.1 SQL Injection Vulnerability

CVE-2018-25425 Overview

CVE-2018-25425 is an SQL injection vulnerability [CWE-89] in Yot CMS version 3.3.1. The flaw resides in the index.php script, which fails to sanitize the aid and cid GET parameters before incorporating them into backend SQL queries. Unauthenticated remote attackers can inject arbitrary SQL payloads through these parameters to read database contents, including table and column names. The issue was assigned CVE-2018-25425 and published to the National Vulnerability Database (NVD) on 2026-05-30. A public exploit is documented as Exploit-DB #45768.

Critical Impact

Unauthenticated attackers can extract sensitive database contents from Yot CMS 3.3.1 deployments using only a crafted HTTP GET request.

Affected Products

• Yot CMS 3.3.1
• Distributed via the Yot project on SourceForge
• Earlier 3.x releases sharing the same index.php parameter handling are likely affected

Discovery Timeline

• 2026-05-30 - CVE-2018-25425 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2018-25425

Vulnerability Analysis

Yot CMS 3.3.1 exposes two query string parameters, aid and cid, through the public index.php entry point. The application concatenates these values directly into SQL statements without parameterized queries or input validation. An attacker appends SQL syntax such as UNION SELECT clauses to either parameter and the database engine evaluates the injected payload as part of the original query.

Because the parameters are reachable over the network and require no authentication or user interaction, exploitation can be fully automated. Successful injection lets attackers enumerate the database schema, dump credentials stored in the CMS, and pivot toward administrative access. The VulnCheck advisory confirms the aid and cid parameters as the injection points.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Yot CMS builds queries through string concatenation, so user-controlled values flow unchanged into the SQL parser. The codebase does not call prepared statements, type-cast numeric IDs, or apply allowlist validation before query execution.

Attack Vector

An attacker issues an HTTP GET request to index.php and supplies an SQL payload in the aid or cid parameter. The injected statement is appended to the legitimate query against the CMS database. Public proof-of-concept payloads in Exploit-DB #45768 demonstrate extracting information_schema tables and columns via the parameters.

The vulnerability manifests in the request handling logic of index.php where $_GET['aid'] and $_GET['cid'] are interpolated into SQL. See the linked Exploit-DB entry and VulnCheck advisory for technical reproduction steps.

Detection Methods for CVE-2018-25425

Indicators of Compromise

• HTTP GET requests to index.php containing SQL metacharacters such as ', UNION, SELECT, --, or 0x within aid or cid parameters
• Repeated requests iterating through information_schema.tables or information_schema.columns
• Web server access logs showing long, URL-encoded query strings targeting aid= or cid=
• Database error messages referencing aid or cid returned to web clients

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL keywords and tautology patterns in aid and cid parameters
• Correlate web access logs with database query logs to identify anomalous query structures originating from the CMS
• Alert on HTTP 500 responses from index.php paired with database driver error strings
• Hunt for outbound traffic from the web host to unfamiliar destinations following suspicious index.php requests

Monitoring Recommendations

• Forward Yot CMS web server logs and database audit logs to a centralized SIEM for correlation and retention
• Track baseline request volumes for index.php and alert on spikes in parameter length or special character ratios
• Monitor authentication tables for unexpected reads, new administrative accounts, or modified password hashes
• Apply file integrity monitoring on index.php and adjacent PHP files to detect attacker-installed webshells

How to Mitigate CVE-2018-25425

Immediate Actions Required

• Restrict network access to Yot CMS 3.3.1 instances until the application can be replaced or rewritten
• Place the affected application behind a WAF with SQL injection rules tuned for the aid and cid parameters
• Audit the database for unauthorized accounts, modified records, and signs of data exfiltration
• Rotate all credentials stored in or reused with the Yot CMS database

Patch Information

No vendor patch is referenced in the available advisories. The Yot project distributes version 3.3.1 from the SourceForge archive, and the project home page does not list a fixed release addressing CVE-2018-25425. Operators should migrate to an actively maintained CMS or apply application-layer compensating controls.

Workarounds

• Decommission Yot CMS 3.3.1 and migrate content to a supported platform that uses parameterized queries
• Add a reverse proxy rule that rejects requests where aid or cid contain non-numeric characters
• Enforce least privilege on the database account used by Yot CMS so injected queries cannot reach sensitive tables
• Disable public access to index.php and require VPN or IP allowlisting for administrative use

# Example nginx rule blocking non-numeric aid/cid values
location = /index.php {
    if ($arg_aid ~ "[^0-9]") { return 403; }
    if ($arg_cid ~ "[^0-9]") { return 403; }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}