CVE-2018-25210

WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter

CVSS 8.8 HIGHEPSS 0.3%CWE-79

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Web-Ofisi · Ticaret V4

References

https://drive.google.com/file/d/1ZghFSsYto-Vpv3PXunx8xm2g-Gs3HJwz/view?usp=sharing https://www.exploit-db.com/exploits/45897 https://www.vulncheck.com/advisories/webofisi-e-ticaret-sql-injection-via-urun-parameter https://www.web-ofisi.com