CVE-2018-5987

published 2018-02-17

CVE-2018-5987: SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the…

Priority P2 64 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
social_pinboard_project	social_pinboard	—	—

Detection & IOCs extracted from sources · hover to see the quote

url index.php?option=com_socialpinboard&view=ajaxcontrol&tmpl=component&task=getlikeinfo&pin_id=[SQL]&user_id=[SQL]↗

url index.php?option=com_socialpinboard&view=gift&starts=100&ends=[SQL]↗

url index.php?option=com_socialpinboard&view=home&category=[SQL]↗

url index.php?option=com_socialpinboard&view=pindisplay&uid=[SQL]↗

url index.php?option=com_socialpinboard&view=search&serachVal=[SQL]↗

url index.php?option=com_socialpinboard&view=likes&uid=[SQL]↗

• → Monitor HTTP requests targeting the Joomla component 'com_socialpinboard' with SQL injection payloads in the parameters: pin_id, user_id (task=getlikeinfo), ends (view=gift), category (view=home), uid (view=pindisplay or view=likes), and serachVal/searchVal (view=search). ↗
• → Alert on any request containing 'option=com_socialpinboard' in the query string combined with SQL metacharacters or INFORMATION_SCHEMA references in any parameter value. ↗

• · The exploit PoC uses 'serachVal' (typo) as the parameter name in the URL, while the NVD advisory spells it 'searchVal'. Detection rules should match both spellings to ensure coverage. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89