CVE-2018-7318

published 2018-02-22

CVE-2018-7318: SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.

Priority P2 70 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
belitsoft	checklist	—	—
oracle	data_integrator	—	—
oracle	data_integrator	—	—
oracle	data_integrator	—	—

Detection & IOCs extracted from sources · hover to see the quote

url index.php?option=com_checklist&view=frontend&title_search=[SQL]&tag_search=[SQL]&name_search=[SQL]&description_search=[SQL]&filter_order=[SQL]↗

command %27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%56%65%72%41%79%61%72%69↗

• → Monitor HTTP requests targeting the Joomla component 'com_checklist' with view=frontend; flag any requests where the parameters title_search, tag_search, name_search, description_search, or filter_order contain SQL metacharacters or encoded payloads. ↗
• → The URL-decoded SQL payload injects: ' AND EXTRACTVALUE(22,CONCAT(0x5c,version(),(SELECT (ELT(1=1,1))),database()))-- VerAyari — detect the string EXTRACTVALUE or CONCAT(0x5c,version() in query parameters targeting com_checklist. ↗
• → Alert on requests to index.php with option=com_checklist and view=frontend combined with any of the five injectable parameters (title_search, tag_search, name_search, description_search, filter_order) containing percent-encoded single quotes (%27) or SQL keywords. ↗

• · The exploit was tested on specific platforms only; behaviour may differ on other OS/web-server combinations. ↗
• · The vulnerable component version is strictly 1.1.1; other versions of CheckList for Joomla! are not confirmed affected by this CVE. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89