vulnwire
8.2high

CVE-2018-25422

MOGG web simulator Script All Version SQL Injection via play.php

Published 5 mo ago · modified 3 mo ago · JSON

CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 18%
Public exploits
0
none known

MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the id parameter. Attackers can send GET requests to play.php with crafted SQL payloads in the id parameter to extract sensitive database information including usernames and other data.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction (EPSS)

0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA3.18.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CNA4.08.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.18.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

  • spider312 MOGG web simulator Script

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • exploit-db.com /exploits/45717 · exploit
  • github.com /spider312/mtgas · product
  • vulncheck.com /advisories/mogg-web-simulator-script-all-version-sql-injection-via-play-php · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.