CVE-2018-25210
WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter
- State
- Published
- Severity
- 8.8 High
- Published
- Mar 26, 2026
- Updated
- Mar 28, 2026
- Reserved
- Mar 26, 2026
Description
WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Ticaret V4Web-Ofisi |
|
References
- ExploitDB-45897exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.