← back
CVE-2018-18619

CVE-2018-18619

EPSS 4.2%
internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter. NOTE: The product is discontinued.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/150261/Advanced-Comment-System-1.0-SQL-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/45853/unverifiedexploitdbwww.exploit-db.com/exploits/45853unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/150261/Advanced-Comment-System-1.0-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2018/Nov/30https://www.exploit-db.com/exploits/45853/