CVE-2018-25431

🗓️ 01 Jun 2026 21:00:21Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Authenticated attackers can inject SQL via the export order_by in No-Cms 1.0 to extract data.

Reporter	Title	Published	Views	Family All 6
CNNVD	No-CMS SQL注入漏洞	1 Jun 202600:00	–	cnnvd
Cvelist	CVE-2018-25431 No-Cms 1.0 SQL Injection via order_by Parameter	1 Jun 202621:00	–	cvelist
EUVD	EUVD-2018-21952	2 Jun 202600:31	–	euvd
NVD	CVE-2018-25431	1 Jun 202622:16	–	nvd
Positive Technologies	PT-2026-45622	1 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2018-25431 No-Cms 1.0 SQL Injection via order_by Parameter	1 Jun 202621:00	–	vulnrichment

Vulners

Node

gofrendiasgard no-cmsMatch1.0

[
  {
    "vendor": "goFrendiAsgard",
    "product": "No-CMS",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/no-cms-sql-injection-via-order-by-parameter
exploit-db	www.exploit-db.com/exploits/45903
github	www.github.com/goFrendiAsgard/No-CMS
codeload	www.codeload.github.com/goFrendiAsgard/No-CMS/zip/master

Parameter	Position	Path	Description	CWE
order_by[0]	request body	/nocms/main/manage_privilege/index/export	SQL injection vulnerability in the export endpoint using the order_by[0] parameter to manipulate database queries	CWE-89

17 Jun 2026 01:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 47.1

CVSS 3.17.1

EPSS0.00273

SSVC

CWE-89