CVE-2018-18702: SQL Injection

Published Oct 27, 2018

Updated

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion.

Affected Software

1 affected component

icmsdev icms=7.0.11

Event History

Oct 27, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-18702.

What is the severity of CVE-2018-18702?

CVE-2018-18702 has a severity rating of 9.8, which is considered critical.

How does CVE-2018-18702 work?

CVE-2018-18702 allows SQL injection through the spider.admincp.php file in iCMS v7.0.11 when accessing admincp.php?app=spider&do=import_rule. The content of the upfile parameter is base64 decoded, deserialized, and used for database insertion.

Which software versions are affected by CVE-2018-18702?

CVE-2018-18702 affects iCMS version 7.0.11.

Is there a fix available for CVE-2018-18702?

No specific fix information is available for CVE-2018-18702 at this time. It is recommended to update to a patched version when it becomes available or to follow any mitigation steps provided by the vendor.