cbcvebase.
CVE-2018-5985
published 2018-01-24

CVE-2018-5985: SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.

PriorityP274critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
19.49%
97.0th percentile
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.

Affected

1 ranges
VendorProductVersion rangeFixed in
livecrmlivecrm_saas_cloud——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://localhost/[PATH]/livecrm/web/index.php?r=site/login&company_id=[SQL]↗
command%31%20%4f%52%20%31%20%47%52%4f%55%50%20%42%59%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%33%61%2c%56%45%52%53%49%4f%4e%28%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%20%48%41%56%49%4e%47%20%4d%49%4e%28%30%29%20%4f%52%20%31↗
  • →Monitor HTTP requests targeting the path /livecrm/web/index.php with query parameters r=site/login and a non-empty or anomalous company_id value, as this is the injection point for CVE-2018-5985. ↗
  • →The URL-decoded payload for the company_id parameter is: 1 OR 1 GROUP BY CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2)) HAVING MIN(0) OR 1 — a classic error-based SQL injection technique using FLOOR(RAND()) to trigger duplicate-entry errors and leak database version information. ↗
  • →Alert on GET requests where the query string contains both r=site/login and company_id= with URL-encoded SQL keywords (e.g., %4f%52 = OR, %47%52%4f%55%50 = GROUP, %43%4f%4e%43%41%54 = CONCAT) as indicators of active exploitation attempts. ↗
  • ·The exploit was tested specifically against LiveCRM SaaS Cloud version 1.0 as a Joomla! component; other versions are not confirmed vulnerable. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.