CVE-2018-12531

CRITICAL

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.

Affects 1 product across 1 vendor.

CVSS 3.09.8
EPSS1.6%
Percentile75th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Metinfo systems (CVE-2018-12531). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-124476-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-12531?
This vulnerability was disclosed in 2018. A critical vulnerability affects Metinfo systems (CVE-2018-12531). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-12531?
CVE-2018-12531 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.6%.
Is CVE-2018-12531 actively exploited?
No confirmed active exploitation of CVE-2018-12531 as of 2026-09-25.
How do I remediate CVE-2018-12531?
Priority: MEDIUM.
What systems are affected by CVE-2018-12531?
CVE-2018-12531 affects Metinfo Metinfo.
Vulnerability Details
CVE IDCVE-2018-12531
BSIDBS-2018-GLOBAL-124476-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2018-06-18
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Metinfo Metinfo 6.0.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3041 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash2a92993c93817517b48fdd2ecde24b7389d11a64b381f48c4c69d7311fa642e5e11578a6f1b40bd6c947a4c3bd96d8e64f2d40f14832cac7d46e64f3e6a2efe0
Related CVEs affecting Metinfo
CVE-2020-21133 9.8 SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?l... CVE-2020-21132 9.8 SQL Injection vulnerability in Metinfo 7.0.0beta in index.php. CVE-2019-17553 9.8 An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via th... CVE-2020-20800 9.8 An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via th... CVE-2020-18175 9.8 SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action i...
View all Metinfo CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →