CVE-2018-25428: Paroiciel 11.20 SQL Injection Vulnerability

CVE-2018-25428 Overview

CVE-2018-25428 is an SQL injection vulnerability [CWE-89] affecting Paroiciel 11.20, a parish management application. The flaw resides in the trec.php endpoint, which fails to sanitize input passed through the tRecIdListe parameter. Unauthenticated attackers can issue crafted GET requests to execute arbitrary SQL statements against the backend database. Successful exploitation enables extraction of database schema details, including table and column names, and disclosure of stored records. A public exploit was published in Exploit-DB entry 45810, lowering the barrier to abuse.

Critical Impact
Remote, unauthenticated attackers can extract sensitive database contents from Paroiciel 11.20 deployments by injecting SQL through the tRecIdListe parameter.

Affected Products

Paroiciel 11.20
Paroiciel installer par6lus_11_20160225.exe distributed via SourceForge
Deployments exposing trec.php over HTTP

Discovery Timeline

2026-06-01 - CVE-2018-25428 published to the National Vulnerability Database (NVD)
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2018-25428

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in Paroiciel 11.20. The trec.php script accepts the tRecIdListe GET parameter and concatenates its value directly into an SQL query. Because no parameterized query, escaping, or type validation is enforced, attacker-supplied SQL syntax is executed by the database engine.

Exploitation requires no authentication and no user interaction. An attacker can append UNION SELECT statements or boolean-based payloads to enumerate tables, columns, and row contents. The flaw maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and can be exploited remotely over the network.

Root Cause

The root cause is missing input validation and the absence of prepared statements in the trec.php handler. The tRecIdListe parameter is treated as trusted data and inserted into a dynamic SQL string. Any character considered syntactically significant by the SQL parser, including single quotes, comments, and statement terminators, reaches the database unchanged.

Attack Vector

The attack vector is a single HTTP GET request to trec.php containing an SQL payload in tRecIdListe. According to the public Exploit-DB entry 45810, attackers can append UNION-based queries to read from information_schema, recovering table and column names before pivoting to retrieve application data. No credentials, session tokens, or prior reconnaissance beyond reachability of the web server are required.

A representative exploitation request resembles GET /trec.php?tRecIdListe=1 UNION SELECT table_name,column_name FROM information_schema.columns issued against a vulnerable host. See the VulnCheck SQL Injection Advisory and Exploit-DB #45810 for the published proof of concept.

Detection Methods for CVE-2018-25428

Indicators of Compromise

HTTP requests to /trec.php containing the tRecIdListe parameter with SQL keywords such as UNION, SELECT, information_schema, or --
Web server access logs showing abnormally long query strings or URL-encoded SQL metacharacters (%27, %20OR%20, %23) targeting trec.php
Unexpected database errors, parse failures, or large response payloads originating from trec.php
Outbound connections or data egress correlated with anomalous reads from Paroiciel database tables

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL syntax tokens in any query parameter sent to trec.php
Enable database query logging and alert on queries referencing information_schema originating from the Paroiciel application user
Compare the rate and volume of responses from trec.php against historical baselines to surface enumeration activity

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation across hosts
Alert on repeated 200-OK responses to trec.php with response sizes that deviate from the legitimate application workflow
Track source IP addresses issuing sequential requests with incrementing or boolean-based payloads against tRecIdListe

How to Mitigate CVE-2018-25428

Immediate Actions Required

Restrict network exposure of trec.php using firewall rules, reverse proxy access controls, or IP allowlists until a fix is in place
Deploy WAF signatures to block SQL metacharacters and UNION SELECT patterns in the tRecIdListe parameter
Audit Paroiciel database accounts and revoke privileges beyond what the application requires, limiting the blast radius of injection
Review web and database logs for prior exploitation matching the indicators above

Patch Information

No vendor patch is referenced in the NVD entry or linked advisories. Operators should monitor the Paroiciel Official Website and the SourceForge Paroiciel Installer project page for an updated build. In the absence of a vendor fix, plan migration away from Paroiciel 11.20 or place the application behind compensating controls.

Workarounds

Place Paroiciel behind a reverse proxy that enforces strict parameter validation and rejects non-numeric values for tRecIdListe
Configure the database account used by Paroiciel with read-only access to the minimum set of tables required by the application
Disable or remove trec.php if the functionality it provides is not required in the deployment

bash

# Example NGINX rule to block SQL syntax in the tRecIdListe parameter
location = /trec.php {
    if ($arg_tRecIdListe ~* "(union|select|information_schema|--|;|/\*)") {
        return 403;
    }
    proxy_pass http://paroiciel_backend;
}