CVE-2018-25128
High
Description
SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by exploiting injection flaws in Login.php and Card_Edit_GetJson.php.
SeverityHigh
CVSS8.2
Exploit probability—
ProductSOCA Access Control System
PublishedDec 24, 2025
First seenDec 24, 2025
Weakness typeCWE-89SQL injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SOCA Technology Co., Ltd SOCA Access Control System | 180612, 170000, 141007 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.