CVE-2018-14418: In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.

PriorityP265critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

9.08%

94.7th percentile

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
msvod	msvod_cms	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/images/lists?cid=13%20)%20ORDER%20BY%201%20desc,extractvalue(rand(),concat(0x7c,database(),0x7c,user(),0x7c,@@version))%20desc%20--%20↗

path/images/lists↗

→Monitor HTTP requests to the /images/lists endpoint for SQL injection patterns in the 'cid' parameter, particularly payloads containing ORDER BY, extractvalue(), concat(), and hex-encoded strings (e.g., 0x7c). ↗
→Use the Google Dork 'inurl:"images/lists?cid=13"' to identify exposed Msvod CMS v10 instances vulnerable to this SQL injection. ↗

·The SQL injection uses an error-based technique via MySQL's extractvalue() function, meaning exploitation is detectable in database error responses rather than blind time-based delays. Detection rules should account for error-based payloads specifically. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.