CVE-2018-19415

Vulnerability

Plikli CMS version 4.0.0 contains blind SQL injection vulnerabilities in two endpoints. The id parameter in join_group.php and the comment_id parameter in story.php are not properly sanitized, allowing an attacker to inject SQL commands via GET requests. [1]

Exploitation

An attacker can exploit these vulnerabilities remotely without authentication by sending crafted HTTP GET requests. For join_group.php, the id parameter is injected with a time-based blind SQL payload (e.g., using SLEEP(25)). Similarly, for story.php, the comment_id parameter is injected. The advisory demonstrates the attack patterns. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the database, potentially leading to data exfiltration, modification, or denial of service. The blind SQL injection can be used to extract sensitive information from the database. [1]

Mitigation

The vendor fixed the issue on 3 August 2018, as per the advisory timeline. Users should upgrade to a patched version of Plikli CMS. No workarounds are provided. [1]