cbcvebase.
CVE-2018-17378
published 2018-09-28

CVE-2018-17378: SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter.

PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
3.28%
86.9th percentile
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
thephpfactorypenny_auction_factory——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://localhost/[PATH]/index.php?option=com_pennyfactory&task=showSearchResults&filter_order_Dir[SQL]&filter_order=[SQL]↗
command%2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29↗
  • →Detect SQL injection attempts targeting the Joomla! Penny Auction Factory component via the 'filter_order_Dir' or 'filter_order' GET parameters in requests to index.php with option=com_pennyfactory&task=showSearchResults ↗
  • →Flag HTTP requests containing 'option=com_pennyfactory' combined with 'task=showSearchResults' and anomalous/encoded values in filter_order_Dir or filter_order parameters as potential SQLi exploitation attempts ↗
  • →The URL-decoded SQL payload injects EXTRACTVALUE, CONCAT, and CONCAT_WS with USER(), DATABASE(), VERSION() — monitor for these SQL function names appearing in filter_order_Dir or filter_order query parameters ↗
  • ·The exploit PoC uses 'localhost' as the target host; in real-world attacks the host will vary — detection rules should not be anchored to a specific hostname but should focus on the component/task/parameter pattern ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.