CVE-2018-25429 Overview
CVE-2018-25429 is a SQL injection vulnerability in Paroiciel 11.20, a parish management application. The flaw resides in the zpro.php endpoint, which fails to sanitize the zProIdPro GET parameter before passing it to a backend SQL query. Authenticated attackers can inject arbitrary SQL statements to extract database contents, including usernames, database names, and version metadata. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers can read arbitrary data from the backing database by injecting SQL payloads into the zProIdPro parameter of zpro.php.
Affected Products
- Paroiciel 11.20
- Distribution package par6lus_11_20160225.exe hosted on SourceForge
- Deployments referenced on the Paroiciel Official Website
Discovery Timeline
- 2026-06-01 - CVE-2018-25429 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2018-25429
Vulnerability Analysis
The vulnerability exists in the zpro.php script of Paroiciel 11.20. The script accepts user-supplied input via the zProIdPro HTTP GET parameter and concatenates the value directly into a SQL query. Because no parameterized queries, prepared statements, or input validation routines are applied, attackers can break out of the intended query context and append arbitrary SQL clauses.
The vulnerability requires authenticated access, but no special privileges or user interaction beyond standard login. Once authenticated, an attacker only needs to craft a single HTTP GET request targeting zpro.php. The VulnCheck SQL Injection Advisory and Exploit-DB entry #45810 document the parameter-level injection point and demonstrate database fingerprinting via UNION-based payloads.
Root Cause
The root cause is direct concatenation of untrusted input into a SQL statement inside zpro.php. The application trusts the zProIdPro parameter without type-checking, escaping, or binding it as a query parameter, which permits operator injection and statement modification.
Attack Vector
The attack vector is network-based over HTTP. An authenticated attacker issues a GET request to zpro.php with a malicious payload in the zProIdPro parameter. Typical payloads use UNION SELECT statements to enumerate user(), database(), and version(), then expand to extract application tables. Because the injection occurs in a parameter that is likely echoed or used in subsequent application logic, both error-based and UNION-based exfiltration techniques are practical.
No verified exploit code is reproduced here. Refer to the Exploit-DB #45810 publication for the proof-of-concept request format.
Detection Methods for CVE-2018-25429
Indicators of Compromise
- HTTP GET requests to /zpro.php containing SQL keywords such as UNION, SELECT, --, 0x, or information_schema in the zProIdPro parameter.
- Web server access logs showing unusually long or URL-encoded values for zProIdPro.
- Database error messages or stack traces returned to clients referencing SQL syntax errors from zpro.php.
- Outbound database queries against information_schema originating from the Paroiciel application user.
Detection Strategies
- Deploy web application firewall (WAF) rules matching SQL injection signatures on requests to zpro.php, focusing on the zProIdPro parameter.
- Enable database query logging and alert on UNION-based or comment-terminated queries originating from the Paroiciel service account.
- Correlate authenticated session activity with anomalous parameter lengths or non-numeric values where numeric identifiers are expected.
Monitoring Recommendations
- Forward web server and database logs to a centralized analytics platform for cross-correlation of authentication events and zpro.php access patterns.
- Baseline normal zProIdPro parameter values and alert on deviations, particularly non-integer payloads or values containing SQL metacharacters.
- Monitor for repeated 500-series HTTP responses from zpro.php, which frequently accompany blind or error-based SQL injection probing.
How to Mitigate CVE-2018-25429
Immediate Actions Required
- Restrict network access to the Paroiciel application to trusted internal users only, ideally behind a VPN or reverse proxy with authentication.
- Audit authentication logs and identify any unexpected accounts capable of reaching zpro.php.
- Rotate database credentials used by the Paroiciel application and limit the database user to the minimum privileges required.
Patch Information
No vendor patch is currently referenced in the NVD entry or vendor resources. Operators should consult the Paroiciel Official Website for updates and contact the vendor for remediation guidance. Until a patched build is available, mitigations must be applied at the network, WAF, and database layers.
Workarounds
- Place a WAF in front of the Paroiciel application with SQL injection signatures enforced on zpro.php and its parameters.
- Configure the database account used by Paroiciel with read-only access to required tables and explicitly deny access to system catalogs such as information_schema.
- Disable or remove the zpro.php endpoint if the affected functionality is not in active use.
- Apply input filtering at a reverse proxy layer to reject zProIdPro values that are not strictly numeric.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
