CVE-2018-18619: internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize…

PriorityP261critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

4.18%

89.7th percentile

internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter. NOTE: The product is discontinued.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
advanced_comment_system_project	advanced_comment_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://x.x.x.x/internal/advanced_comment_system/admin.php?pw=admin&page=/internal/index.php%27%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(0x71717a6b71,0x67424663534f77556d44746a59686f78427354754268636b5466486249616b724d716e4869634758,0x7171626a71),NULL--%20SkrU&del=2↗

path/internal/advanced_comment_system/admin.php↗

→Monitor HTTP requests to /internal/advanced_comment_system/admin.php containing SQL UNION SELECT payloads in the 'page' parameter, particularly with URL-encoded single quotes (%27) and CONCAT with hex-encoded strings. ↗
→Look for the hex-encoded canary strings 0x71717a6b71 ('qqzkq') and 0x7171626a71 ('qqbjq') in HTTP request/response traffic, which are characteristic of this specific SQLi proof-of-concept payload. ↗
→Flag requests to admin.php that include both the 'pw' and 'page' parameters where 'page' contains path traversal or SQL metacharacters (e.g., single quote, UNION, SELECT). ↗

·The vulnerable software (Advanced Comment System 1.0) is discontinued; no patch is available. Detection/blocking is the only mitigation. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.