Which versions of PHP are affected by CVE-2018-25188?

Webiness Inventory 2.3 contains a critical unauthenticated SQL injection vulnerability that could allow attackers to access, modify, or delete sensitive inventory data without authentication.

Is there a public PoC exploit available for CVE-2018-25188?

Yes, a public proof-of-concept exploit is available for CVE-2018-25188. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2018-25188?

Within 24 hours: Identify all systems running Webiness Inventory 2.3 and isolate them from internet-facing access; implement WAF rules to block SQL injection patterns in the order parameter. Within 7 days: Deploy network segmentation to restrict access to Webiness Inventory to authorized internal users only; enable comprehensive logging and monitoring for suspicious database queries. Within 30 days: Evaluate alternative inventory management solutions or contact Webiness for security guidance; conduct a forensic audit of database logs for signs of exploitation.

PHP CVE-2018-25188

Q: What is the CVSS score of CVE-2018-25188?

CVE-2018-25188 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

SQL Injection (CWE-89)

2026-03-06 disclosure@vulncheck.com

PHP SQLi

8.8

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 09, 2026 - 13:35 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 13:16 nvd

HIGH 8.2

DescriptionNVD

Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the order parameter. Attackers can send POST requests to the WsModelGrid.php endpoint with crafted SQL payloads to extract sensitive database information including usernames, databases, and version details.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the order parameter. Attackers can send POST requests to the WsModelGrid.php endpoint with crafted SQL payloads to extract sensitive database information including usernames, databases, and version details.

Affected ProductsAI

Component: order.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2018-25188 vulnerability details – vuln.today

Back

PHP CVE-2018-25188

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

PHP CVE-2018-25188

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code