Is CVE-2018-25429 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25429 being exploited in the wild.

How severe is CVE-2018-25429?

High severity, with a CVSS score of 7.1, published 1 June 2026.

Which products and versions are affected?

Paroiciel Association Paroiciel 11.20 and earlier.

Is there a fix for CVE-2018-25429?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25429 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25429?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25429: Paroiciel SQL injection in multiple PHP components

CVE-2018-25429 · Severity: high · CVSS 7.1 · Published 2026-06-01

Paroiciel, a software used for managing Catholic parish records and pastoral data, contains a security flaw that could allow an authorized user to access sensitive database information. By sending specially crafted web requests, an attacker with basic login credentials can bypass security controls to view private data such as usernames, database structures, and system version details. This could lead to unauthorized data exposure and provide a foothold for further attacks on the organization's information systems.

Quick answers

Is CVE-2018-25429 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25429 being exploited in the wild.
How severe is CVE-2018-25429?: High severity, with a CVSS score of 7.1, published 1 June 2026.
Which products and versions are affected?: Paroiciel Association Paroiciel 11.20 and earlier.
Is there a fix for CVE-2018-25429?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25429 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25429?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in Paroiciel version 11.20 and potentially earlier versions due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is present in several PHP components, specifically within the 'zProIdPro' parameter of zpro.php, the 'tRecIdListe' parameter of trec.php, and the 'eGeqIdEquipe' parameter of egeq.php. An authenticated attacker can exploit this by sending crafted GET requests containing UNION-based or error-based SQL payloads. Successful exploitation allows the attacker to execute arbitrary SQL queries to extract sensitive information including database names, table structures, and version details. While the vendor has released newer versions (e.g., 11.30), users should ensure they are running a version that addresses these legacy injection points.

Affected products

Paroiciel Association Paroiciel 11.20 and earlier

Timeline

2018-11-09: disclosed: Initial discovery and proof of concept by Ihsan Sencan
2018-11-12: other: Exploit published on Exploit-DB
2026-06-01: advisory: CVE-2018-25429 published via VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.