CVE-2018-25178— Easyndexer 1.0 Arbitrary File Download via showtif.php
Quick assessment
Affected
Sourceforge Easyndexer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Easyndexer是rul10个人开发者的一个数据库界面软件。 Easyndexer 1.0版本存在路径遍历漏洞，该漏洞源于showtif.php中的file参数存在任意文件下载，可能导致下载系统配置文件。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-25178
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easyndexer 1.0 Arbitrary File Download via showtif.php
Source: CVE Program / CVE List V5
Vulnerability Description
Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Easyndexer 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Easyndexer是rul10个人开发者的一个数据库界面软件。 Easyndexer 1.0版本存在路径遍历漏洞，该漏洞源于showtif.php中的file参数存在任意文件下载，可能导致下载系统配置文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sourceforge | Easyndexer | 1.0 | - |
|
II. Public POCs for CVE-2018-25178
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25178
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2018-25178 (1)
Same Patch Batch · Sourceforge · 2026-03-06 · 6 CVEs total
| CVE-2018-25166 | 8.2 HIGH | Meneame English Pligg 5.8 SQL Injection via search Parameter |
| CVE-2018-25192 | 8.2 HIGH | GPS Tracking System 2.12 SQL Injection via username Parameter |
| CVE-2018-25189 | 8.2 HIGH | Data Center Audit 2.6.2 SQL Injection via username Parameter |
| CVE-2018-25177 | 5.3 MEDIUM | Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php |
| CVE-2018-25190 | 5.3 MEDIUM | Easyndexer 1.0 Cross-Site Request Forgery via createuser.php |
IV. Related Vulnerabilities
Same vendor: Sourceforge
-
CVE-2019-25705
Echo Mirage 3.1 Stack Buffer Overflow via Rules Action Field -
CVE-2018-25251
Snes9K 0.0.9z Buffer Overflow SEH via Netplay Socket -
CVE-2018-25209
OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter -
CVE-2019-25632
phpFileManager 1.7.8 Local File Inclusion via index.php -
CVE-2019-25575
SimplePress CMS 1.0.7 SQL Injection via p and s Parameters
Same weakness: CWE-22
-
CVE-2026-112051
Xinference through 4.0.1 Path Traversal via model_name in Cu -
CVE-2026-112049
Vita3K before build 4187 Path Traversal via VPK Package Inst -
CVE-2026-112015
Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os -
CVE-2026-112005
WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via D -
CVE-2026-110253
weForms <= 1.6.28 - Unauthenticated Limited Media File Delet
V. Comments for CVE-2018-25178
No comments yet