CVE-2018-25430 Overview
CVE-2018-25430 is a SQL injection vulnerability in Paroiciel 11.20, a parish management application. The flaw resides in the egeq.php endpoint, where the eGeqIdEquipe parameter is concatenated into a SQL query without proper sanitization. Authenticated attackers can send crafted GET requests to execute arbitrary SQL statements against the backing database. Successful exploitation enables extraction of database version information, schema details, and stored records. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers can extract sensitive database contents from Paroiciel 11.20 by injecting SQL through the eGeqIdEquipe parameter on egeq.php.
Affected Products
- Paroiciel 11.20
- Distributions packaged via par6lus_11_20160225.exe
- Deployments referenced by the Paroiciel project
Discovery Timeline
- 2026-06-01 - CVE-2018-25430 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2018-25430
Vulnerability Analysis
The vulnerability stems from unsanitized user input passed directly into a SQL query. The egeq.php script accepts the eGeqIdEquipe parameter via HTTP GET and interpolates it into a SQL statement without parameterized queries or input validation. An authenticated attacker can append SQL operators such as UNION SELECT to retrieve arbitrary records, including the database version banner. The Exploit-DB entry #45810 documents the injection payload format. The flaw maps to [CWE-89] and affects confidentiality of database contents.
Root Cause
The root cause is direct string concatenation of HTTP request parameters into SQL queries within egeq.php. The application does not employ prepared statements, type casting, or input allowlists for the eGeqIdEquipe parameter. This permits an attacker to break out of the intended integer context and inject arbitrary SQL clauses.
Attack Vector
The attack vector is network-based and requires low-privilege authentication to the Paroiciel application. An attacker issues a GET request to egeq.php with a malicious value supplied to eGeqIdEquipe. The injected payload is executed by the database engine and the response returns data extracted from arbitrary tables. The VulnCheck advisory details the parameter behavior.
The vulnerability manifests in the query handler for egeq.php. No verified proof-of-concept code is reproduced here; refer to the Exploit-DB entry for the documented payload structure.
Detection Methods for CVE-2018-25430
Indicators of Compromise
- HTTP GET requests to egeq.php containing SQL keywords such as UNION, SELECT, @@version, or comment sequences (--, /*) in the eGeqIdEquipe parameter.
- Web server access logs showing non-numeric or unusually long values for eGeqIdEquipe.
- Database error messages or version banners returned in HTTP responses from egeq.php.
Detection Strategies
- Inspect web server and application logs for malformed eGeqIdEquipe values and correlate with anomalous database query activity.
- Deploy web application firewall signatures targeting common SQL injection patterns on the Paroiciel endpoint.
- Monitor database audit logs for unexpected INFORMATION_SCHEMA queries originating from the Paroiciel service account.
Monitoring Recommendations
- Enable verbose query logging on the database backing Paroiciel and alert on queries containing UNION SELECT outside expected templates.
- Track authentication events to Paroiciel and correlate them with high-volume requests to egeq.php.
- Forward web and database telemetry to a centralized SIEM for retention and cross-source correlation.
How to Mitigate CVE-2018-25430
Immediate Actions Required
- Restrict network access to the Paroiciel application to trusted users and internal networks only.
- Audit existing accounts and remove unused credentials that could be leveraged for authenticated exploitation.
- Place a web application firewall in front of egeq.php with rules blocking SQL metacharacters in the eGeqIdEquipe parameter.
Patch Information
No official vendor patch is listed in the NVD record for CVE-2018-25430. Operators should consult the Paroiciel project website for current release information and consider migration if the deployed version 11.20 remains unsupported.
Workarounds
- Add server-side input validation that enforces strict integer typing on the eGeqIdEquipe parameter before query construction.
- Replace string-concatenated SQL with parameterized queries in the egeq.php handler.
- Apply least-privilege configuration to the database account used by Paroiciel so that INFORMATION_SCHEMA and cross-database reads are denied.
# Example ModSecurity rule blocking SQLi attempts on the vulnerable parameter
SecRule ARGS:eGeqIdEquipe "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|@@version|information_schema)" \
"id:1002543,phase:2,deny,status:403,msg:'CVE-2018-25430 SQLi attempt on egeq.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
