Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Pedidos 1.0 allows attackers to access sensitive database info

CVE-2018-25172 · published 8 months ago
Summary

The Pedidos 1.0 software has a security weakness that allows unauthorized users to access sensitive information about your database. This means they can potentially see the layout of your database and its contents. You should update to a fixed version of Pedidos to prevent this.

Original advisory text
Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send ...
Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to the ajax/load_proveedores.php endpoint with crafted SQL payloads to extract sensitive database information including schema names and table structures.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published6 Mar 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2018-25172 · NVD
Track software like this
Free during beta