CVE-2018-25428

Paroiciel 11.20 SQL Injection via tRecIdListe Parameter

Published Jun 1, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tRecIdListe parameter. Attackers can send GET requests to the trec.php endpoint with crafted SQL payloads to extract database information including table and column names.

Analysis

Technical impact

Paroiciel 11.20 contains an unauthenticated SQL injection flaw where an attacker can inject malicious SQL code via the tRecIdListe parameter in GET requests to the trec.php endpoint. This flaw permits execution of arbitrary SQL statements, enabling the attacker to retrieve sensitive data such as database table and column names. The vulnerability does not allow direct modification of data according to the official description, but it exposes confidential information that could be leveraged by further attacks.

Affected Systems

The flaw is limited to Paroiciel version 11.20. No other product versions are listed as affected in the CNA data.

Risk and Exploitability

The CVSS score of 8.8 classifies this vulnerability as high severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. If the Paroiciel instance is accessible from the internet, the flaw can be exploited without authentication, making the risk significant for exposed deployments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Paroiciel

affected

Version	Status	Constraints
`11.20`	affected	—

No data.

Vendor Product Versions

Paroiciel

Version	Status	Scheme	Platform
`11.20`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any vendor issued patch or upgrade Paroiciel to a version that addresses the SQL injection issue (if an update is available).
Restrict access to the trec.php endpoint by requiring user authentication or by blocking it through a web‑application firewall or network firewall.
Modify application code to validate and sanitize the tRecIdListe parameter, or replace the vulnerable query with a parameterized statement to prevent arbitrary SQL execution.

Generated by OpenCVE AI on June 1, 2026 at 22:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.341% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://datapacket.dl.sourceforge.net/project/paroiciel/version%2011/par6lus_11_20160225.exe
https://www.exploit-db.com/exploits/45810
https://www.paroiciel.com/
https://www.vulncheck.com/advisories/paroiciel-sql-injection-via-trecidliste-parameter

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Paroiciel Paroiciel paroiciel
Vendors & Products		Paroiciel Paroiciel paroiciel

Jun 2, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tRecIdListe parameter. Attackers can send GET requests to the trec.php endpoint with crafted SQL payloads to extract database information including table and column names.
Title		Paroiciel 11.20 SQL Injection via tRecIdListe Parameter
Weaknesses		CWE-89
References		https://datapacket.dl.sourceforge.net/project/paroiciel/version%2011/par6lus_11_20160225.exe https://www.exploit-db.com/exploits/45810 https://www.paroiciel.com/ https://www.vulncheck.com/advisories/paroiciel-sql-injection-via-trecidliste-parameter
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`