CVE-2018-5986

published 2018-01-24

CVE-2018-5986: SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
easycarscript	easycarscript	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/[PATH]/site_search.php?s_vehicletype=auto&s_order=[SQL]&s_row=[SQL]↗

path /site_search.php↗

command %35%31%20%2f%2a%21%30%35%35%35%35%50%72%6f%63%65%64%75%72%65%2a%2f%20%2f%2a%21%30%35%35%35%35%41%6e%61%6c%79%73%65%2a%2f%20%28%65%78%74%72%61%63%74%76%61%6c%75%65%28%30%2c%2f%2a%21%30%35%35%35%35%63%6f%6e%63%61%74%2a%2f%28%30%78%32%37%2c%30%78%33%61%2c%40%40%76%65%72%73%69%6f%6e%2c%64%61%74%61%62%61%73%65%28%29%29%29%2c%30%29%2d%2d%20%2d↗

• → Monitor HTTP requests to site_search.php for SQL injection patterns in the s_order and s_row GET parameters, particularly URL-encoded SQL keywords and comment sequences (e.g., /*!05555Procedure*/, /*!05555Analyse*/, extractvalue, concat). ↗
• → The proof-of-concept payload URL-decodes to a MySQL versioned comment-based blind/error SQLi using PROCEDURE ANALYSE and extractvalue() with concat(0x27,0x3a,@@version,database()) — alert on these patterns in query strings targeting site_search.php. ↗

• · The exploit was tested on specific platforms only; behaviour may differ on other OS/DB configurations. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89