CVE-2018-25189

Data Center Audit 2.6.2 SQL Injection via username Parameter

CVSS 8.8 HIGHEPSS 0.2%CWE-89

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames, database names, and version details.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Sourceforge · Data Center Audit

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/45807 https://www.vulncheck.com/advisories/data-center-audit-sql-injection-via-username-parameter