Executive brief
Paroiciel, a software used for managing Catholic parish records and pastoral data, contains a security flaw that could allow an authorized user to access sensitive database information. By sending specially crafted web requests, an attacker with basic login credentials can bypass security controls to view private data such as usernames, database structures, and system version details. This could lead to unauthorized data exposure and provide a foothold for further attacks on the organization's information systems.
Technical details
An SQL injection vulnerability exists in Paroiciel version 11.20 and potentially earlier versions due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is present in several PHP components, specifically within the 'zProIdPro' parameter of zpro.php, the 'tRecIdListe' parameter of trec.php, and the 'eGeqIdEquipe' parameter of egeq.php. An authenticated attacker can exploit this by sending crafted GET requests containing UNION-based or error-based SQL payloads. Successful exploitation allows the attacker to execute arbitrary SQL queries to extract sensitive information including database names, table structures, and version details. While the vendor has released newer versions (e.g., 11.30), users should ensure they are running a version that addresses these legacy injection points.
Affected products
- Paroiciel Association Paroiciel 11.20 and earlier
Timeline
- 2018-11-09: disclosed: Initial discovery and proof of concept by Ihsan Sencan
- 2018-11-12: other: Exploit published on Exploit-DB
- 2026-06-01: advisory: CVE-2018-25429 published via VulnCheck and NVD