CVE-2018-25172

🗓️ 06 Mar 2026 12:19:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

SQL injection in Pedidos version 1.0 allows access via q parameter to disclose schema and tables.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2018-25172	6 Mar 202612:19	–	attackerkb
Circl	CVE-2018-25172	6 Mar 202614:17	–	circl
CNNVD	Pedidos SQL注入漏洞	6 Mar 202600:00	–	cnnvd
Cvelist	CVE-2018-25172 Pedidos 1.0 SQL Injection via load_proveedores.php	6 Mar 202612:19	–	cvelist
EUVD	EUVD-2018-21627	6 Mar 202615:31	–	euvd
NVD	CVE-2018-25172	6 Mar 202613:15	–	nvd
Positive Technologies	PT-2026-23684	6 Mar 202600:00	–	ptsecurity
Vulnrichment	CVE-2018-25172 Pedidos 1.0 SQL Injection via load_proveedores.php	6 Mar 202612:19	–	vulnrichment

Vulners

Node

obedalvarado pedidosMatch1.0

[
  {
    "vendor": "Obedalvarado",
    "product": "Pedidos",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/45856
vulncheck	www.vulncheck.com/advisories/pedidos-sql-injection-via-load-proveedoresphp

Parameter	Position	Path	Description	CWE
q	query param	ajax/load_proveedores.php	SQL injection via the q parameter in a GET request to ajax/load_proveedores.php, allowing unauthenticated attackers to execute arbitrary SQL and extract database/schema information.	CWE-89

17 Jun 2026 01:54Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.2

CVSS 48.8

EPSS0.00293

SSVC

CWE-89