CVE-2018-25171 - EdTv 2 SQL Injection via id Parameter · CoreCVE

Back Back to CVE browser

HIGH

EdTv 2 SQL Injection via id Parameter

Published Mar 6, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.29%

Description

EdTv 2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the admin/edit_source endpoint with crafted SQL UNION statements to extract database information including schema names, user credentials, and version details.

Affected products

Vendor Edtv Product EdTv Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://www.exploit-db.com/exploits/45849
exploit
https://www.vulncheck.com/advisories/edtv-sql-injection-via-id-parameter
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/45849		exploit
https://www.vulncheck.com/advisories/edtv-sql-injection-via-id-parameter		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulnCheck

Published Mar 6, 2026

Updated Mar 9, 2026

Reserved Mar 6, 2026

Link CVE-2018-25171

CISA Vulnrichment

Updated Mar 9, 2026

Status Deferred

Modified Jun 17, 2026

Link CVE-2018-25171

Severity n/a

Public date n/a

Links CVE-2018-25171