Which versions of PHP are affected by CVE-2018-25163?

BitZoom 1.0 contains a critical SQL injection vulnerability in its authentication system that allows unauthenticated attackers to bypass login controls and extract sensitive database information…

Is there a public PoC exploit available for CVE-2018-25163?

Yes, a public proof-of-concept exploit is available for CVE-2018-25163. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2018-25163?

Within 24 hours: Audit all BitZoom 1.0 instances in production and take inventory of exposed systems and data sensitivity; isolate or disable BitZoom 1.0 if business-critical data is at risk. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in login.php and forgot.php parameters; implement input validation and parameterized query enforcement; conduct forensic log analysis for evidence of exploitation. Within 30 days: Evaluate migration to patched versions or alternative authentication solutions; complete security assessment of compromised systems; notify affected users if unauthorized access is confirmed.

PHP CVE-2018-25163

Q: What is the CVSS score of CVE-2018-25163?

CVE-2018-25163 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

SQL Injection (CWE-89)

2026-03-06 disclosure@vulncheck.com

PHP SQLi

8.8

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 09, 2026 - 13:35 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 13:15 nvd

HIGH 8.2

DescriptionNVD

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.

Affected ProductsAI

Component: rollno and username.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2018-25163 vulnerability details – vuln.today

Back

PHP CVE-2018-25163

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

PHP CVE-2018-25163

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code