CVE-2018-25422 HIGH

CVE-2018-25422: MOGG web simulator Script All Version SQL Injection via play.php

Vendor Spider312
Product MOGG web simulator Script
Weakness CWE-89 · SQLi
Published May 30, 2026
Last update June 1, 2026

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the id parameter. Attackers can send GET requests to play.php with crafted SQL payloads in the id parameter to extract sensitive database information including usernames and other data.

Key dates

Disclosure timeline

May 30, 2026 CVE published
June 1, 2026 Record updated