WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter

Published 7 mo ago 2026-03-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.2

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 20%

Public exploits

none known

WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago 2026-03-28

Exploit prediction (EPSS)

0.28% probability of exploitation in the next 30 days, higher than 20% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.8	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`
CNA	3.1	8.2	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`
CNA	4.0	8.8	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	8.2	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`
NVD	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected products

Web-Ofisi Ticaret V4

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exploit-db.com /exploits/45897 · exploit
web-ofisi.com · product
drive.google.com /file/d/1ZghFSsYto-Vpv3PXunx8xm2g-Gs3HJwz/view?usp=sharing · product
vulncheck.com /advisories/webofisi-e-ticaret-sql-injection-via-urun-parameter · third-party-advisory

Sources

CVE List: CVE-2018-25210
NVD: CVE-2018-25210

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary