CVE-2018-25430: SQL Injection in Paroiciel 11.20 egeq.php – High Risk Vulnerability Guide

Technical summary

CVE-2018-25430 is a server-side SQL injection vulnerability affecting Paroiciel 11.20. The flaw exists in the egeq.php script, specifically in how the eGeqIdEquipe parameter is processed. The application fails to properly sanitize or parameterize this input before incorporating it into SQL queries. An authenticated attacker can craft GET requests containing malicious SQL syntax—such as UNION SELECT statements or comment sequences—to execute arbitrary queries against the application's database backend. The vulnerability maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). While authentication is required, the attack surface remains significant in multi-user environments or where account compromise is plausible.

Business impact

SQL injection in authenticated workflows undermines data confidentiality and can lead to unauthorized information disclosure. An attacker with valid credentials—whether a disgruntled employee, a compromised contractor account, or a threat actor using stolen credentials—can extract sensitive customer data, intellectual property, internal records, or system configuration details. Database version and schema information disclosed via the vulnerability aids further reconnaissance. In regulated industries, such breaches trigger notification and remediation obligations, damage to customer trust, and potential compliance violations.

Affected systems

This vulnerability specifically affects Paroiciel version 11.20. Organizations running this version with the egeq.php endpoint accessible should prioritize assessment. The vendors_products field in the source data is empty, suggesting limited public documentation of deployment scope; verify your inventory against your Paroiciel installations. If you operate earlier or later versions of Paroiciel, consult vendor advisories to determine if they are affected.

Exploitability

Exploitability is moderate in practical terms. The flaw requires valid authentication, which limits opportunistic attacks but does not eliminate risk—compromised or insider accounts are common attack vectors. Once authenticated, no additional complexity is needed; a simple HTTP GET request with a malicious SQL payload will trigger the injection. Automated scanning tools and manual testing can easily confirm the presence of this vulnerability. Public proof-of-concept code or scanning signatures may exist, lowering the barrier for less-skilled attackers.

Remediation

Upgrade Paroiciel to a patched version released after this vulnerability was identified. Contact the vendor to obtain the specific version number and patch guidance applicable to your deployment. If an immediate patch is unavailable, implement input validation by whitelist (accepting only expected values for eGeqIdEquipe), use parameterized queries or prepared statements in the egeq.php code, and enforce principle of least privilege on database accounts used by the application. Monitor database activity logs for suspicious query patterns indicative of injection attempts.

Patch guidance

The vendor should have released patches after the vulnerability disclosure on 2026-06-01 and the last modification date of 2026-06-17. Check the official Paroiciel vendor website or your support portal for available updates. When patching becomes available, test it in a non-production environment first to confirm it resolves the SQL injection without breaking legitimate application functionality. Update your documentation to reflect the new version once deployed. Verify the patch by re-testing the eGeqIdEquipe parameter with known SQL injection payloads.

Detection guidance

Monitor HTTP request logs for GET requests to egeq.php containing suspicious characters or SQL syntax in the eGeqIdEquipe parameter, such as single quotes, semicolons, UNION, SELECT, OR, and comment sequences (--,%23). Enable database query logging to detect anomalous queries, such as unexpected UNION-based statements or SELECT operations outside normal workflow patterns. Use Web Application Firewall (WAF) rules to block requests matching common SQL injection patterns. Conduct code review and static application security testing (SAST) on the egeq.php file and related query-building logic.

Why prioritize this

Although this vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, its HIGH CVSS score of 7.1, coupled with authenticated SQL injection in a production web application, merits prompt attention. The combination of high confidentiality impact, network accessibility, and straightforward exploitability makes it a priority for inventory, patching, and compensating controls. Organizations with Paroiciel 11.20 in use should treat this as a near-term remediation target, particularly if the affected endpoint is accessible to multiple internal users or if user accounts are frequently shared or compromised.

Risk score, explained

The CVSS v3.1 score of 7.1 (HIGH) reflects: Attack Vector = Network (accessible remotely), Attack Complexity = Low (no special conditions needed once authenticated), Privileges Required = Low (authentication is required but not admin-level access), User Interaction = None (the attack is automatic), Scope = Unchanged (impact is limited to the affected component), Confidentiality = High (sensitive data can be extracted), Integrity = Low (the attacker can modify data but the vulnerability primarily enables reads), and Availability = None (the flaw does not directly cause denial of service). This scoring appropriately emphasizes the information disclosure risk while acknowledging the authentication prerequisite.

Frequently asked questions