cbcvebase.
CVE-2018-7538
published 2018-03-12

CVE-2018-7538: A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary…

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
4.46%
90.2th percentile
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands.

Affected

1 ranges
VendorProductVersion rangeFixed in
enaleantuleap< 9.189.18

Detection & IOCsextracted from sources · hover to see the quote

url/plugins/tracker/?tracker=16↗
command(select(0)from(select(sleep(3)))a)/**/↗
path/plugins/tracker/↗
  • →Detect time-based blind SQLi attempts against the Tuleap tracker endpoint by monitoring POST requests to /plugins/tracker/ containing sleep() payloads in the criteria[] body parameters, particularly the pattern (select(0)from(select(sleep(N)))a)/**/ in URL-encoded form fields. ↗
  • →Alert on POST requests to /plugins/tracker/ where the body contains URL-encoded SQL time-delay constructs such as %28select%280%29from%28select%28sleep and the response time exceeds 3 seconds. ↗
  • →Flag use of the anomalous User-Agent 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)' in POST requests to /plugins/tracker/ as it was used in the published PoC exploit. ↗
  • →Monitor for the __Host-TULEAP_PHPSESSID cookie name in requests; its presence combined with SQLi patterns in POST body parameters to /plugins/tracker/ is a strong indicator of exploitation. ↗
  • →Exploitation may not require authentication depending on project visibility; monitor unauthenticated POST requests to /plugins/tracker/ for SQL injection patterns in addition to authenticated sessions. ↗
  • ·The injected parameter is criteria[499][values][] in the POST body; the numeric field ID (499) may vary across Tuleap installations and tracker configurations, so detection rules should match the pattern criteria[*][values][] rather than the specific field ID 499. ↗
  • ·The tracker ID in the URL (?tracker=16) is installation-specific and will differ per deployment; detection should not be anchored to tracker=16 but rather to the /plugins/tracker/ path with any tracker parameter. ↗
  • ·Successful exploitation privilege depends on the database user; default is 'restricted' with MySQL, but arbitrary OS command execution is possible if higher DB privileges are granted. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.