CVE-2018-18425
Last modified
CVE-2018-18425 is a vulnerability of currently unknown severity. The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.). EPSS estimates a 1.08% chance of exploitation in the next 30 days.
Description
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Primeo Project | Primeo | All versions |
References
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
- https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#codeThird Party Advisory
- https://www.jianshu.com/p/09f238e9e568Exploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-18425?
How severe is CVE-2018-18425?
How do I fix CVE-2018-18425?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-18416LANGO Codeigniter Multilingual Script 1.0 has XSS in the inp…
- CVE-2018-18417In the 3.1 version of Ekushey Project Manager CRM, Stored XS…
- CVE-2018-18419Stored XSS has been discovered in the upload section of ARDA…
- CVE-2018-1842IBM Cognos Analytics 11 Configuration tool, under certain ci…3.6
- CVE-2018-18420Cross-Site Request Forgery (CSRF) vulnerability was discover…
- CVE-2018-18422UsualToolCMS 8.0 allows CSRF for adding a user account via t…
- CVE-2018-18426s-cms 3.0 allows remote attackers to execute arbitrary PHP c…
- CVE-2018-18427s-cms 3.0 allows SQL Injection via the member/post.php 0_id …
- CVE-2018-18428TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthentic…
- CVE-2018-1843The Identity and Access Management (IAM) services (IBM Cloud…4.1
- CVE-2018-18430An issue was discovered in DESTOON B2B 7.0. admin\setting.in…
- CVE-2018-18431An issue was discovered in DESTOON B2B 7.0. XSS exists via c…
Are you affected by CVE-2018-18425?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST