CVE-2018-25187 Tina4 Stack 1.0.3 SQL Injection and Database File Download
Unauthenticated attackers can execute SQL injection and download database files to steal credentials in Tina4 Stack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25187?
CVE-2018-25187 is a high-severity SQL injection vulnerability in Tina4 Stack, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. Attackers can directly request the kim.db database file to retrieve user credentials and password hashes, or inject SQL code through the menu endpoint to manipulate database queries.
Weakness: CWE-89
Which versions are affected by CVE-2018-25187?
It affects 1 product.
Products include Tina4 Tina4 Stack.
How do I fix CVE-2018-25187?
No fix has been published for CVE-2018-25187 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-25187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25187 exists.
Other vulnerabilities in Tina4 Stack
Sources
Also known as GHSA-69cw-9g25-672r.