CVE-2018-25429: SQL Injection in Paroiciel 11.20 – zpro.php zProIdPro Parameter

Technical summary

The vulnerability exists in the zpro.php file where the zProIdPro parameter is processed without proper input validation or parameterized query construction. Attackers can inject SQL metacharacters and commands through GET requests to bypass query logic and execute unintended SQL operations. The flaw maps to CWE-89 (SQL Injection) and allows extraction of database schema and content through error-based or union-based injection techniques. The attack surface is limited to authenticated sessions, reducing but not eliminating risk in environments with shared or compromised credentials.

Business impact

This vulnerability enables insider threats and compromised account holders to exfiltrate sensitive data stored in Paroiciel databases without triggering typical access controls. Organizations relying on Paroiciel for sensitive operations face potential data breaches, regulatory compliance violations (GDPR, HIPAA, PCI-DSS depending on data stored), and reputational damage. The ability to extract database metadata and user credentials amplifies the risk of lateral movement and privilege escalation within the affected infrastructure.

Affected systems

Paroiciel version 11.20 is confirmed vulnerable. Organizations should verify whether they are running this specific version or any prior versions that may contain the same flaw. The vendor product list was not provided in available advisories, so consultation with Paroiciel vendor documentation or support is necessary to determine the full scope of affected installations and whether versions before or after 11.20 are impacted.

Exploitability

Exploitation requires valid authentication credentials to access the zpro.php endpoint, which significantly raises the bar compared to unauthenticated attacks. However, the vulnerability is straightforward to exploit once authenticated—attackers need only craft and send a single HTTP GET request with a malicious SQL payload. No special tools or complex conditions are required. The CVSS vector reflects low attack complexity and no user interaction needed, making this a high-priority concern for organizations with weak access controls or credential compromise risks.

Remediation

Apply the security patch released by Paroiciel for version 11.20. Ensure input validation and use parameterized queries (prepared statements) to neutralize SQL injection. Implement principle of least privilege by restricting database account permissions to the minimum necessary for application functions. Consider network segmentation to limit access to zpro.php from trusted hosts only, and monitor authentication logs for suspicious account activity.

Patch guidance

Contact Paroiciel support or check their advisory portal for the patched version addressing this SQL injection flaw. Verify patch availability and compatibility with your deployment environment before applying. Test patches in a non-production environment to ensure no functional regression. Once patches are available, prioritize deployment to systems running version 11.20 given the HIGH severity rating and ease of exploitation for authenticated users.

Detection guidance

Monitor HTTP GET requests to zpro.php for unusual zProIdPro parameter values containing SQL keywords (SELECT, UNION, OR, AND, etc.) or metacharacters (single quotes, dashes, comments). Enable database query logging to detect anomalous SQL execution patterns, such as queries attempting to access system tables or unusual data extraction. Alert on failed SQL syntax errors returned to web clients, which may indicate injection attempts. Review authentication logs for credential abuse or concurrent sessions from unexpected locations.

Why prioritize this

Although the CVSS score is 7.1 (HIGH), the authentication requirement limits immediate risk in properly secured environments. However, this should still be prioritized for patching within 30 days due to: (1) high confidentiality impact (C:H) permitting full database disclosure, (2) straightforward exploitation once authenticated, (3) potential for credential harvesting enabling further attacks, and (4) applicability to any organization with weak password policies or credential compromise incidents.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH-severity vulnerability with network-accessible attack vector, low attack complexity, and high confidentiality impact. The requirement for authentication (PR:L) prevents it from reaching a CRITICAL score, but the high confidentiality impact and ability to extract sensitive identifiers justify the elevated rating. Integrity impact is low (data can be modified but is not the primary objective), and availability is not affected.

Frequently asked questions