# CVE-2018-25428: Paroiciel SQL injection in multiple PHP endpoints

Source: https://junglewise.ai/threats/cve-2018-25428-paroiciel-sql-injection-in-multiple-php-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2018-25428 · Severity: high · CVSS 8.2 · Published 2026-06-01

Paroiciel, a software suite used for managing Catholic parish records and pastoral data, contains a security flaw that allows unauthorized individuals to access its database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive information, including database structures and potentially personal records. This could lead to the exposure of private community data and compromise the confidentiality of parish operations.

Technologies: [Paroiciel](https://junglewise.ai/threats/technologies/paroiciel). Vendors: [Paroiciel](https://junglewise.ai/threats/vendors/paroiciel).

## Quick answers

**Is CVE-2018-25428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25428 being exploited in the wild.

**How severe is CVE-2018-25428?** High severity, with a CVSS score of 8.2, published 1 June 2026.

**Which products and versions are affected?** Paroiciel 11.20 and earlier.

**Is there a fix for CVE-2018-25428?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25428 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2018-25428?** Check whether you run Paroiciel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Paroiciel version 11.20 and potentially earlier versions due to improper neutralization of special elements in several PHP endpoints. Specifically, the 'tRecIdListe' parameter in trec.php, the 'zProIdPro' parameter in zpro.php, and the 'eGeqIdEquipe' parameter in egeq.php are susceptible to manipulation via GET requests. An unauthenticated remote attacker can exploit these flaws by submitting crafted SQL payloads to execute arbitrary queries. This allows for the extraction of database schema information, table names, column names, and sensitive data stored within the database. While the vendor has released newer versions (e.g., 11.30), users should verify they are running a version that addresses these specific injection points.

## Affected products

- Paroiciel Association Paroiciel 11.20 and earlier

## Timeline

- 2018-11-09: disclosed: Initial discovery and proof of concept by researcher
- 2018-11-12: other: Exploit published on Exploit-DB
- 2026-06-01: advisory: CVE formally published and assigned by VulnCheck

## References

- [https://datapacket.dl.sourceforge.net/project/paroiciel/version%2011/par6lus_11_20160225.exe](https://datapacket.dl.sourceforge.net/project/paroiciel/version%2011/par6lus_11_20160225.exe)
- [https://www.exploit-db.com/exploits/45810](https://www.exploit-db.com/exploits/45810)
- [https://www.paroiciel.com/](https://www.paroiciel.com/)
- [https://www.vulncheck.com/advisories/paroiciel-sql-injection-via-trecidliste-parameter](https://www.vulncheck.com/advisories/paroiciel-sql-injection-via-trecidliste-parameter)

## Related threats

- [Paroiciel SQL injection in multiple PHP endpoints](https://junglewise.ai/threats/cve-2018-25430-paroiciel-sql-injection-in-multiple-php-endpoints)