CVE-2018-25163 - BitZoom 1.0 SQL Injection via rollno Parameter

Back Back to CVE browser

HIGH

BitZoom 1.0 SQL Injection via rollno Parameter

Published Mar 6, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.26%

Description

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.

Affected products

Vendor Bitzoom Product BitZoom Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bitzoom

BitZoom

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21618
Advisory
https://www.exploit-db.com/exploits/45862
exploit
https://www.vulncheck.com/advisories/bitzoom-sql-injection-via-rollno-parameter
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21618		Advisory
https://www.exploit-db.com/exploits/45862		exploit
https://www.vulncheck.com/advisories/bitzoom-sql-injection-via-rollno-parameter		third-party-advisory