CVE-2018-25431

No-Cms 1.0 SQL Injection via order_by Parameter

Published Jun 1, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries. Attackers can submit POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.

Analysis

Technical impact

The vulnerability is a classic SQL injection in the order_by parameter of the manage_privilege export endpoint. Authenticated attackers can craft POST requests to /nocms/main/manage_privilege/index/export and embed malicious SQL in order_by[0] to manipulate queries and exfiltrate sensitive database data, potentially compromising confidentiality of the entire system.

Affected Systems

The affected product is No-CMS 1.0 from the vendor goFrendiAsgard (ASGARD). All installations using this version are vulnerable; no specific sub‑versions are listed beyond 1.0.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered high severity. Because the EPSS score is not available, the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, but it requires authenticated access to the export endpoint, so the attack vector is likely an authenticated internal attacker. If the attacker obtains valid credentials, they can harvest sensitive data before the patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

goFrendiAsgard

No-CMS

affected

Version	Status	Constraints
`1.0`	affected	—

No data.

Vendor Product Versions

Gofrendiasgard

No-cms

Version	Status	Scheme	Platform
`1.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest No‑CMS patch or upgrade to a version where the order_by parameter is removed or properly sanitised.
Limit access to the /nocms/main/manage_privilege/index/export endpoint to authorized administrators only and consider disabling or disabling the order_by feature if possible.
Monitor web server logs for abnormal POST requests to the export endpoint and enforce strict input validation to detect and block potential injection attempts.

Generated by OpenCVE AI on June 1, 2026 at 22:28 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.273% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master
https://github.com/goFrendiAsgard/No-CMS
https://www.exploit-db.com/exploits/45903
https://www.vulncheck.com/advisories/no-cms-sql-injection-via-order-by-parameter

History

Jul 28, 2026 2:30 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		No-cms Project No-cms Project no-cms
CPEs		cpe:2.3:a:no-cms_project:no-cms:1.0:::::::*
Vendors & Products		No-cms Project No-cms Project no-cms

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gofrendiasgard Gofrendiasgard no-cms
Vendors & Products		Gofrendiasgard Gofrendiasgard no-cms

Jun 2, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries. Attackers can submit POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.
Title		No-Cms 1.0 SQL Injection via order_by Parameter
Weaknesses		CWE-89
References		https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master https://github.com/goFrendiAsgard/No-CMS https://www.exploit-db.com/exploits/45903 https://www.vulncheck.com/advisories/no-cms-sql-injection-via-order-by-parameter
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`