PT-2018-14335 · Wikidforum · Wikidforum

Publicado 2018-10-09 · Atualizado 2018-11-21 · CVE-2018-18075

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WikidForum version 2.20

Description The issue concerns SQL Injection, which can be exploited through specific parameters in the software. The vulnerable parameters include parent post id and num records in the 'rpc.php' endpoint, as well as the select sort parameter in the 'index.php?action=search' endpoint.

Recommendations For WikidForum version 2.20, consider restricting access to the rpc.php and index.php endpoints until a patch is available. As a temporary workaround, avoid using the parent post id, num records, and select sort parameters in the affected endpoints to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18075

Produtos afetados

Wikidforum

Referências · 4

• 🔥 https://exploit-db.com/exploits/45564 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18075 · Aviso do Fabricante
• https://seccops.com/wikidforum-2-20-multiple-sql-injection-vulnerabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18075 · Nota de Segurança