CVE-2018-5979

published 2018-01-24

CVE-2018-5979: SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.

Priority P2 66 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wchat_project	wchat	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/[PATH]/login.php↗

command ' UNION ALL SELECT 0x31,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x33,0x34-- XXX↗

• → SQL injection payload targeting the 'User' field of login.php in Wchat 1.5; monitor POST/GET requests to login.php containing UNION ALL SELECT or SQL comment sequences (-- XXX) ↗
• → Vulnerable endpoint is login.php; inspect input to the 'User' field for unsanitized SQL metacharacters such as single quotes and UNION-based injection strings ↗

• · The exploit PoC uses 'localhost' as the host; in real deployments the path prefix [PATH] must be substituted with the actual installation directory of Wchat 1.5 ↗
• · The password field value is irrelevant to exploitation; any value is accepted ('anything'), meaning authentication bypass is achievable purely via the User field ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89