Which versions of PHP are affected by CVE-2018-25170?

DoceboLMS 1.2 is vulnerable to unauthenticated SQL injection attacks that allow attackers to extract, modify, or delete sensitive data directly from the database without valid credentials.

Is there a public PoC exploit available for CVE-2018-25170?

Yes, a public proof-of-concept exploit is available for CVE-2018-25170. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2018-25170?

Within 24 hours: Identify all systems running DoceboLMS 1.2 and isolate them or restrict network access to trusted users only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the id, idC, and idU parameters, and consider disabling affected features if possible. Within 30 days: Upgrade to a patched version of DoceboLMS or migrate to an alternative LMS solution; conduct a forensic audit for signs of unauthorized database access.

PHP CVE-2018-25170

Q: What is the CVSS score of CVE-2018-25170?

CVE-2018-25170 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-06 disclosure@vulncheck.com

PHP SQLi CSRF

8.8

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 09, 2026 - 13:35 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 13:15 nvd

HIGH 8.2

DescriptionNVD

DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information.

AnalysisAI

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information.

Affected ProductsAI

DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code throu

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2018-25170 vulnerability details – vuln.today

Back

PHP CVE-2018-25170

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

PHP CVE-2018-25170

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code