CVE-2018-25399 in Open ISES Project
Summary
by MITRE • 05/29/2026
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tick_lat and tick_lng parameters. Attackers can send GET requests to nearby.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/22/2026
The Open ISES Project version 3.30A presents a critical SQL injection vulnerability that fundamentally compromises the integrity and confidentiality of the underlying database system. This vulnerability exists within the nearby.php script which processes geographical coordinate parameters tick_lat and tick_lng without proper input validation or sanitization mechanisms. The flaw represents a classic example of inadequate parameter handling where user-supplied data directly influences SQL query construction, creating an attack surface that unauthenticated adversaries can exploit to gain unauthorized access to sensitive database information.
The technical implementation of this vulnerability stems from the application's failure to employ prepared statements or proper input filtering techniques when processing the tick_lat and tick_lng parameters. When attackers submit GET requests containing malicious SQL payloads through these parameters, the application concatenates the raw input directly into SQL queries without appropriate escaping or parameterization. This design flaw allows attackers to manipulate the intended query execution flow and inject additional SQL commands that execute with the privileges of the database user account used by the web application.
The operational impact of this vulnerability extends beyond simple data theft as it provides attackers with comprehensive database reconnaissance capabilities. Successful exploitation enables unauthorized access to usernames, database schema information, version details, and potentially sensitive personal or administrative data stored within the database. The vulnerability's unauthenticated nature means that any remote attacker can exploit it without requiring prior credentials or privileged access, making it particularly dangerous for publicly accessible web applications. This exposure creates opportunities for further attacks including privilege escalation, data manipulation, and potential system compromise through additional attack vectors.
Security professionals should immediately address this vulnerability by implementing proper input validation and parameterized queries throughout the application codebase. The recommended mitigation strategy involves replacing direct SQL query construction with prepared statements that separate the SQL logic from user input, ensuring that malicious payloads cannot alter the intended query structure. Additionally, implementing proper access controls, input sanitization measures, and regular security audits can help prevent similar vulnerabilities from emerging in future iterations of the software. This vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws, and represents a technique commonly categorized under ATT&CK tactic TA0006 (Credential Access) and technique T1190 (Exploit Public-Facing Application).
Organizations utilizing this software should conduct immediate vulnerability assessments to identify potential exploitation attempts and implement network-level protections including web application firewalls and intrusion detection systems. The remediation process must include comprehensive code review of all database interaction points to ensure similar vulnerabilities do not exist elsewhere in the application architecture, as SQL injection represents a persistent threat that requires systematic defensive measures across the entire software development lifecycle.