PT-2018-14335 · Wikidforum · Wikidforum

Published 2018-10-09 · Updated 2018-11-21 · CVE-2018-18075

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WikidForum version 2.20

Description The issue concerns SQL Injection, which can be exploited through specific parameters in the software. The vulnerable parameters include parent post id and num records in the 'rpc.php' endpoint, as well as the select sort parameter in the 'index.php?action=search' endpoint.

Recommendations For WikidForum version 2.20, consider restricting access to the rpc.php and index.php endpoints until a patch is available. As a temporary workaround, avoid using the parent post id, num records, and select sort parameters in the affected endpoints to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-18075

Affected Products

Wikidforum

References · 4

• 🔥 https://exploit-db.com/exploits/45564 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18075 · Security Note
• https://seccops.com/wikidforum-2-20-multiple-sql-injection-vulnerabilities · Note