Skip to content
Fencer Intel
medium 5.5

CVE-2018-25070 json

polterguy Phosphorus Five CSV Import NonQuery.cs csv.Read sql injection

published 3y ago modified 4mo ago also EUVD-2018-13830

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.

Patch / fix

Is CVE-2018-25070 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA 3.0 5.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA 2.0 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • polterguy Phosphorus Five

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.