PT-2018-14339 · Duomi · Duomicms

Mochazz · Published 2018-10-09 · Updated 2020-06-17 · CVE-2018-18084

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DuomiCMS version 3.0

Description An issue exists in the software, specifically a SQL injection in the ajax.php file. This is demonstrated by the uid parameter.

Recommendations For DuomiCMS version 3.0, consider restricting access to the ajax.php file or avoiding the use of the uid parameter until a fix is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-18084

Affected Products

Duomicms

References · 4

• 🔥 https://github.com/Mochazz/Mochazz.github.io/blob/master/2018/09/30/DuomiCms3.0%E6%9C%80%E6%96%B0%E7%89%88%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98/index.html · Exploit
• 🔥 https://mochazz.github.io/2018/09/30/DuomiCms3.0%E6%9C%80%E6%96%B0%E7%89%88%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18084 · Security Note