CVE-2018-25187 is a high severity flaw (CVSS 8.2) in Tina4 Stack 1.0.3, combining SQL injection with an exposed database file. The record names no fixed version. Remove public access to the database file, fix the injectable endpoint and check the vendor.
What's affected
- Product: Tina4 Stack.
- Version: 1.0.3.
- Fixed version: none confirmed in the record. The VulnCheck advisory page listed in the record returned not found when I tried it, so check the project directly.
- Weakness: CWE-89, SQL injection.
- CVSS 8.2, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
The record describes two problems. An unauthenticated attacker can request the database file named kim.db directly and retrieve user credentials and password hashes. Separately, the menu endpoint can be used to inject SQL.
How to check if you're exposed
Check whether the database file sits under the web root and whether the web server serves it. From a machine outside your network, request the file path on your own site and look at the response code. A download means anyone can fetch it.
find /var/www -name "*.db" 2>/dev/null
Any database file in a directory that the web server serves is the same kind of problem, whatever the product. Then read the code behind the menu endpoint for queries built from request values.
What to do now
- Find all Tina4 Stack installs and confirm the version.
- Move the database file outside the web root, or deny access to it in the web server configuration.
- Assume the credentials and hashes in that file were readable. Rotate all passwords stored there.
- Replace string-built queries in the menu endpoint with prepared statements.
- Check access logs for direct requests to the database file name.
- Check the project for a fixed release. None is confirmed here.
Why it matters
The exposed file matters more than the injection. A user table with password hashes, downloaded in one request, needs no query tricks at all. The record rates the attack network reachable, low complexity and unauthenticated.
The record lists a public Exploit-DB entry. That means the details are public, not that attacks were seen. The CISA KEV flag is false. The injection side is ordinary CWE-89: request data joined into a query.
Quick check
Do I need to rotate passwords?
If the file was ever reachable from the web, yes. You cannot tell from the file alone whether someone downloaded it, so rotate and then check logs.
Sources
Last reviewed: 19 October 2026.
