CVE-2018-12630
📋 TL;DR
CVE-2018-12630 is a critical SQL injection vulnerability in NEWMARK NMCMS 2.1 that allows attackers to execute arbitrary SQL commands via the sect_id parameter in the /catalog URI. This affects all users running the vulnerable version of this content management system. Successful exploitation can lead to complete database compromise.
💻 Affected Systems
- NEWMARK NMCMS
- New Mark NMCMS
📦 What is this software?
Nmcms by Nmark
⚠️ Risk & Real-World Impact
Worst Case
Complete database takeover including data theft, modification, or deletion; potential remote code execution if database permissions allow; full system compromise.
Likely Case
Database information disclosure including user credentials, sensitive content, and configuration data; potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries in place; database access restricted to least privilege.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication; simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - No official patch identified
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
1. Upgrade to a newer version if available. 2. If no newer version exists, implement input validation and parameterized queries. 3. Apply web application firewall rules to block SQL injection patterns.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the sect_id parameter
# Example ModSecurity rule: SecRule ARGS:sect_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
allAdd input validation to only accept numeric values for sect_id parameter
# PHP example: if(!is_numeric($_GET['sect_id'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from critical assets
- Deploy a web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Send a test request to /catalog with sect_id parameter containing SQL injection payload (e.g., sect_id=1' OR '1'='1) and check for database errors or unexpected responsesCheck Version:
Check CMS version in admin panel or configuration files; look for version 2.1 in code comments or configurationVerify Fix Applied:
Test with the same SQL injection payloads and verify they are rejected or properly sanitized without database errors📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /catalog with SQL keywords in sect_id parameter
- Database error messages in web server logs
- Unusual database query patterns
Network Indicators:
- HTTP requests containing SQL injection patterns in URL parameters
- Multiple rapid requests to /catalog endpoint with varying sect_id values
SIEM Query:
source="web_server" AND (uri_path="/catalog" AND (param="sect_id" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|create|alter|exec|declare)"))