CVE-2018-25206 HIGH

CVE-2018-25206: KomSeo Cart 1.3 SQL Injection via edit.php

Vendor Sitemakin
Product KomSeo Cart
Weakness CWE-89 · SQLi
Published March 26, 2026
Last update March 28, 2026

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attackers can submit POST requests with malicious SQL payloads to extract sensitive database information using boolean-based blind or error-based injection techniques.

Key dates

Disclosure timeline

March 26, 2026 CVE published
March 28, 2026 Record updated