How to fix CVE-2018-25175?

Within 24 hours: Inventory all systems running Alienor Web Libre 2.0 and isolate affected instances from production networks if possible. Within 7 days: Implement WAF rules blocking SQL injection patterns in the 'identifiant' parameter, enable SQL error suppression, and establish database access monitoring and alerting. Within 30 days: Migrate to a supported alternative application or perform a comprehensive security assessment to evaluate continued operational risk and compliance exposure.

Is PHP affected by CVE-2018-25175?

Alienor Web Libre 2.0 contains a critical SQL injection vulnerability (CVE-2018-25175) that allows unauthenticated attackers to bypass authentication and access or manipulate sensitive database information.

CVE-2018-25175

HIGH

2026-03-06 [email protected]

8.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 09, 2026 - 13:35 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 13:15 nvd

HIGH 8.2

Description

Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the identifiant parameter. Attackers can submit crafted POST requests to index.php with SQL injection payloads in the identifiant field to extract sensitive database information including usernames, databases, and version details.

Analysis

Technical Context

Classified as CWE-89 (SQL Injection). Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the identifiant parameter. Attackers can submit crafted POST requests to index.php with SQL injection payloads in the identifiant field to extract sensitive database information including usernames, databases, and version details.

Affected Products

Component: identifiant.

Remediation

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +41

POC: +20

CVE-2018-25175 vulnerability details – vuln.today

Back

CVE-2018-25175

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2018-25175

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code