Quick answers
- Is CVE-2018-25340 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-25340 being exploited in the wild.
- How severe is CVE-2018-25340?
- High severity, with a CVSS score of 8.2, published 23 May 2026.
- Which products and versions are affected?
- Smakosh Smartshop 1.0.
- Is there a fix for CVE-2018-25340?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2018-25340 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2018-25340?
- Check whether you run Smakosh Smartshop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A SQL injection vulnerability exists in Smartshop 1 due to improper neutralization of user-supplied input in the 'id' and 'searched' parameters. The application directly concatenates GET parameters into SQL queries within category.php, product.php, and search.php without sufficient sanitization or the use of prepared statements. An unauthenticated remote attacker can exploit this by sending crafted GET requests containing UNION-based or time-based blind SQL injection payloads. Successful exploitation allows the attacker to extract sensitive information from the database, including user credentials and database structure. The vulnerability was publicly disclosed in 2018, but formal CVE assignment occurred later.
Affected products
- Smakosh Smartshop 1.0
Timeline
- 2018-06-02: disclosed: Original exploit published on Exploit-DB
- 2026-05-23: advisory: CVE published and assigned by VulnCheck