VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 1, 2026

CVE-2018-25430

CVE-2018-25430

Description

Paroiciel 11.20 is vulnerable to SQL injection via the eGeqIdEquipe parameter, allowing authenticated users to extract sensitive database information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Paroiciel 11.20 is vulnerable to SQL injection via the eGeqIdEquipe parameter, allowing authenticated users to extract sensitive database information.

Vulnerability

Paroiciel version 11.20 contains an SQL injection vulnerability. This vulnerability is present in the egneq.php endpoint and is triggered by injecting malicious SQL code through the eGeqIdEquipe parameter. The vulnerability affects versions of Paroiciel up to and including 11.20 [3].

Exploitation

An attacker needs to be authenticated to exploit this vulnerability. The attacker can send GET requests to the egneq.php endpoint. By crafting specific SQL payloads within the eGeqIdEquipe parameter, the attacker can execute arbitrary SQL queries [3]. Reference [1] provides a proof-of-concept URL structure for a similar SQL injection vulnerability in Paroiciel, indicating a potential exploitation path.

Impact

Successful exploitation of this SQL injection vulnerability allows an authenticated attacker to execute arbitrary SQL queries. This can lead to the extraction of sensitive database information, including version details and other confidential data. The scope of the compromise is limited to the data accessible by the application's database user [3].

Mitigation

Paroiciel version 11.30 and later versions are expected to contain fixes for this vulnerability. The vendor's website indicates that version 11.30 is the current version, along with an update V11.30-01 [2]. Users are advised to upgrade to the latest available version of Paroiciel to mitigate this risk. No specific patch release date for version 11.20 has been disclosed in the available references.

References
  1. OffSec’s Exploit Database Archive
  2. Accueil
  3. Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter

AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The application does not properly sanitize user-supplied input in the eGeqIdEquipe parameter, leading to SQL injection."

Attack vector

An authenticated attacker can exploit this vulnerability by sending a crafted GET request to the `egeq.php` endpoint. The malicious payload is injected into the `eGeqIdEquipe` parameter. This allows the attacker to execute arbitrary SQL queries, potentially extracting sensitive database information such as version details and other data [ref_id=1].

Affected code

The vulnerability exists in the `egeq.php` script, specifically concerning the `eGeqIdEquipe` parameter. The provided reference indicates that this parameter is susceptible to SQL injection when used in requests to this endpoint [ref_id=1].

What the fix does

The provided bundle does not contain information about a patch or specific remediation steps. Therefore, the advisory does not specify how the vulnerability is fixed. Users are advised to consult the vendor for updated versions or security patches.

Preconditions

  • authThe attacker must be authenticated to the application.
  • inputThe `eGeqIdEquipe` parameter must be controllable by the attacker.

Reproduction

1) Navigate to `http://localhost/[PATH]/html/egeq.php?eGeqActEquipe=M&eGeqIdEquipe=[SQL]` 2) Inject a crafted SQL payload into the `eGeqIdEquipe` parameter, for example: `' /*!50000Procedure*/ /*!50000Analyze*/ (extractvalue(0,concat(0x27,@@version)))-- -` [ref_id=1]

Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.