PT-2018-14751 · Nuuo · Nuuo Cms

Pedro Ribeiro · Published 2018-11-27 · Updated 2019-10-09 · CVE-2018-18982

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NUUO CMS versions 3.3 and prior

Description The web server application in NUUO CMS allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.

Recommendations For versions 3.3 and prior, update to a version later than 3.3 to resolve the issue. If no newer version is available, consider restricting access to the web server application to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-18982

Affected Products

Nuuo Cms

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/nuuo/nuuo_cms_sqli.rb · Exploit
• 🔥 https://exploit-db.com/exploits/46449 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18982 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18982 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02 · Note