PT-2018-14339 · Duomi · Duomicms

Mochazz · Publicado 2018-10-09 · Atualizado 2020-06-17 · CVE-2018-18084

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DuomiCMS version 3.0

Description An issue exists in the software, specifically a SQL injection in the ajax.php file. This is demonstrated by the uid parameter.

Recommendations For DuomiCMS version 3.0, consider restricting access to the ajax.php file or avoiding the use of the uid parameter until a fix is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18084

Produtos afetados

Duomicms

Referências · 4

• 🔥 https://github.com/Mochazz/Mochazz.github.io/blob/master/2018/09/30/DuomiCms3.0%E6%9C%80%E6%96%B0%E7%89%88%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98/index.html · Exploit
• 🔥 https://mochazz.github.io/2018/09/30/DuomiCms3.0%E6%9C%80%E6%96%B0%E7%89%88%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18084 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18084 · Nota de Segurança