CVE-2018-25431

🗓️ 01 Jun 2026 21:00:21Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Authenticated attackers can inject SQL via the export order_by in No-Cms 1.0 to extract data.

Reporter	Title	Published	Views	Family All 7
CNNVD	No-CMS SQL注入漏洞	1 Jun 202600:00	–	cnnvd
Cvelist	CVE-2018-25431 No-Cms 1.0 SQL Injection via order_by Parameter	1 Jun 202621:00	–	cvelist
EUVD	EUVD-2018-21952	2 Jun 202600:31	–	euvd
NVD	CVE-2018-25431	1 Jun 202622:16	–	nvd
Positive Technologies	PT-2026-45622	1 Jun 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2018-25431: Improper Neutralization of Special Elements used in an SQL Command	1 Jun 202600:00	–	rapid7
Vulnrichment	CVE-2018-25431 No-Cms 1.0 SQL Injection via order_by Parameter	1 Jun 202621:00	–	vulnrichment

Vulners

CNA

Node

gofrendiasgard no-cmsMatch1.0

[
  {
    "vendor": "goFrendiAsgard",
    "product": "No-CMS",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/45903
github	www.github.com/goFrendiAsgard/No-CMS
codeload	www.codeload.github.com/goFrendiAsgard/No-CMS/zip/master
vulncheck	www.vulncheck.com/advisories/no-cms-sql-injection-via-order-by-parameter

Parameter	Position	Path	Description	CWE
order_by[0]	request body	/nocms/main/manage_privilege/index/export	SQL injection vulnerability in the order_by[0] parameter of the manage_privilege export endpoint, enabling authenticated attackers to modify queries and extract sensitive data.	CWE-89
order_by[0]	request body	/nocms/main/manage_privilege/index/export	SQL injection vulnerability in the order_by[0] parameter of the manage_privilege export endpoint, enabling authenticated attackers to modify queries and extract sensitive data.	CWE-89

28 Jul 2026 01:46Current

5.8Medium risk

Vulners AI Score5.8

CVSS 47.1

CVSS 3.17.1

EPSS0.00273

SSVC

CWE-89