CVE-2018-13045
📋 TL;DR
This is a critical SQL injection vulnerability in Yeswiki Cercopitheque that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the 'Bazar' page. Attackers can potentially read, modify, or delete database content, and in worst cases gain full system control. All users running Yeswiki Cercopitheque version 2018-06-19-1 or earlier are affected.
💻 Affected Systems
- Yeswiki Cercopitheque
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, and potential remote code execution via database functions, resulting in full system takeover.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation to administrative access within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Multiple public exploit scripts are available, making this easily exploitable by attackers with minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2018-06-19-1
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Upgrade Yeswiki Cercopitheque to the latest version. 2. If upgrading is not possible, apply the security patch that implements proper input validation and parameterized queries for the 'id' parameter in the Bazar page.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allImplement WAF rules to block SQL injection patterns in the 'id' parameter
Input Validation Filter
allAdd server-side validation to only accept numeric values for the 'id' parameter
🧯 If You Can't Patch
- Implement strict input validation to only allow numeric values for the 'id' parameter
- Deploy a web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Test the Bazar page with SQL injection payloads in the 'id' parameter (e.g., ' OR '1'='1) and observe if database errors or unexpected behavior occurs.Check Version:
Check the Yeswiki version in the application's admin panel or configuration filesVerify Fix Applied:
After patching, test with the same SQL injection payloads and verify they are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts following SQL injection attempts
- Suspicious 'id' parameter values containing SQL keywords
Network Indicators:
- HTTP requests with SQL injection patterns in the 'id' parameter
- Unusual database query patterns from the application server
SIEM Query:
source="web_logs" AND (uri="*/Bazar*" AND (param="id" AND value="*' OR *" OR value="*;--*" OR value="*UNION*"))