CVE-2018-25425: Unauthenticated SQL Injection in Yot CMS 3.3.1

Technical summary

CVE-2018-25425 is a classic SQL injection flaw (CWE-89) in Yot CMS 3.3.1 where user-supplied input in the aid and cid parameters is not properly sanitized before being incorporated into SQL queries. The vulnerability exists in index.php and is exploitable via GET requests, allowing attackers to bypass authentication and execute arbitrary SQL operations. Successful exploitation enables data exfiltration, including enumeration of database structure, table names, and column definitions.

Business impact

An attacker exploiting this vulnerability could extract sensitive data from the CMS database, potentially including user credentials, configuration data, and business-critical information. Unlike vulnerabilities limited to data modification, this flaw emphasizes confidentiality breach, though limited integrity impact is also possible. For organizations running Yot CMS 3.3.1, exposure of database schemas and user information could lead to further compromise, regulatory violations, and reputational damage.

Affected systems

Yot CMS version 3.3.1 is affected. Organizations should verify whether this or related versions are deployed in their environment. Given the age of the vulnerability publication (May 2026), it is critical to establish whether systems have been patched or upgraded. Newer versions of Yot CMS should be checked against vendor advisories to confirm patched status.

Exploitability

The vulnerability has a CVSS 3.1 exploitability subscore reflecting no authentication requirement, low attack complexity, and network accessibility. Exploitation requires only crafted HTTP GET requests—no user interaction or special privileges. The attack can be mounted by any unauthenticated internet user with network access to the CMS. The straightforward nature of SQL injection in this context suggests moderate to high real-world exploitability; however, the vulnerability has not been flagged for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the last modification date.

Remediation

Upgrade Yot CMS to a version that patches this SQL injection vulnerability. Verify the specific patched version through the Yot CMS vendor advisory or release notes. As an interim control, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the aid and cid parameters. Restrict network access to the CMS if deployment context permits. Input validation and parameterized queries should be verified in any patched release.

Patch guidance

Contact Yot CMS vendor for definitive patch version information and apply the update as soon as possible. Given the high CVSS score and ease of exploitation, this should be prioritized in your patching cycle. Verify patch deployment by confirming the CMS version and testing that SQL injection payloads in aid and cid parameters are properly rejected. Document the patching timeline for compliance records.

Detection guidance

Monitor web server access logs and application logs for suspicious patterns in GET requests to index.php, particularly those containing SQL keywords (SELECT, UNION, OR, AND, etc.) in the aid or cid parameters. Implement log correlation to identify multiple injection attempts from the same source. Network-based detection via WAF rules for SQL injection signatures in query strings is effective. Database activity monitoring can also detect anomalous SQL execution patterns resulting from injected queries.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.2), unauthenticated and network-accessible attack vector, and high confidentiality impact. The lack of KEV listing does not diminish urgency; it reflects that no in-the-wild weaponized exploits have been formally cataloged, not that the flaw is low-risk. Organizations running Yot CMS 3.3.1 should treat this as a priority remediation target, particularly if the CMS contains sensitive data.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects: (1) Network attack vector—accessible from any internet connection; (2) Low attack complexity—no special conditions required; (3) No authentication—unauthenticated users can exploit; (4) High confidentiality impact—direct database access; (5) Limited integrity and no availability impact. The score appropriately captures the severity of unauthenticated data exfiltration while acknowledging that direct system destruction is not the primary threat.

Frequently asked questions