CVE-2018-11535

published 2018-05-29

CVE-2018-11535: An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.

Priority P2 60 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sitemakin	slac	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /login-script-demo/users.php↗

path /home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php↗

command my_item_search=1337'and extractvalue(5566,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -&submit=Search↗

command my_item_search=1337'and extractvalue(5566,concat(0x7e,(select column_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -&submit=Search↗

• → Detect POST requests to /login-script-demo/users.php containing 'extractvalue' and 'concat(0x7e' in the my_item_search parameter body, indicative of XPath/SQL injection exploitation. ↗
• → Monitor HTTP responses for the error string 'SQLSTATE[HY000]: General error: 1105 XPATH syntax error' as a sign of successful blind SQL/XPath injection triggering. ↗
• → Flag POST bodies to users.php where my_item_search contains SQL comment sequences such as '-- -' combined with extractvalue() calls, characteristic of error-based SQL injection payloads. ↗

• · The exploit targets SLAC v1.0 specifically; the affected endpoint path '/login-script-demo/users.php' reflects the demo installation path and may differ in production deployments. ↗
• · The vulnerable parameter 'my_item_search' is submitted via HTTP POST to users.php; WAF or IDS rules must inspect POST body content, not just URL query strings, to detect this attack. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89