Security readout for executives and security teams
Plain-English summary
This issue lets an unauthenticated remote attacker abuse a database query in MOGG web simulator Script. If an affected site is reachable, sensitive database data such as usernames may be exposed. The source bundle cites a public exploit, but does not show confirmed active exploitation or a vendor patch.
Executive priority
Prioritize any public deployment because the flaw is unauthenticated, network-reachable, and has public exploit material. The business concern is database confidentiality, especially usernames and related application data. If the software is not present, no further action is needed beyond documentation.
Technical view
CVE-2018-25422 is a CWE-89 SQL injection in play.php through the id parameter. The CVSS 4.0 score is 8.8, with network access, low complexity, no privileges, and no user interaction required. Reported impact is high confidentiality impact and low integrity impact, with no availability impact stated.
Likely exposure
Exposure is most likely on internet-facing deployments of spider312 MOGG web simulator Script where play.php is accessible. The advisory title says all versions, but the provided affected version data is not specific. Asset owners should confirm whether this script or the mtgas project is present.
Exploitation context
The bundle includes an ExploitDB reference tagged as an exploit, so public exploit information exists. KEV is false, and the provided sources do not claim active exploitation in the wild. Treat reachable instances as high risk because exploitation requires no authentication or user interaction.
Researcher notes
Evidence is limited to the supplied CVE, VulnCheck, ExploitDB, and project references. The affected version field is non-specific, while the advisory title states all versions. No patch, commit, release, or active exploitation evidence is included in the bundle.
Mitigation direction
- Identify any deployed MOGG web simulator Script or mtgas instances.
- Check CVE, VulnCheck, and project guidance for an official fix.
- If no fix exists, remove or isolate the affected script from public access.
- Restrict access to play.php until vendor-supported remediation is available.
- Review database and web logs for suspicious id parameter activity.
- Assess exposed database data and rotate credentials if compromise is suspected.
Validation and detection
- Search asset inventory and repositories for MOGG web simulator Script or mtgas.
- Confirm whether public sites expose play.php.
- Review application logs for unusual requests to play.php with id parameters.
- Verify whether any vendor or project update has been applied.
- Check database audit logs for unexpected reads or schema enumeration.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25422 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-45717CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: MOGG web simulator Script All Version SQL Injection via play.phpCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.