CVE-2018-5696
📋 TL;DR
This SQL injection vulnerability in iJoomla's com_adagency plugin for Joomla! allows attackers to execute arbitrary SQL commands through the advertiser_status and status_select parameters. Websites running the vulnerable plugin version are affected, potentially exposing database contents including user credentials and sensitive data.
💻 Affected Systems
- iJoomla com_adagency plugin for Joomla!
📦 What is this software?
Ad Agency by Ijoomla
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, remote code execution, or complete site takeover.
Likely Case
Database information disclosure including user credentials, sensitive business data, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
SQL injection via URL parameters makes exploitation straightforward with readily available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.10 or later
Vendor Advisory: https://www.ijoomla.com/
Restart Required: No
Instructions:
1. Update com_adagency plugin to version 6.0.10 or later via Joomla! Extension Manager. 2. Verify update completes successfully. 3. Clear Joomla! cache.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for advertiser_status and status_select parameters
Modify index.php to sanitize $_GET['advertiser_status'] and $_GET['status_select'] parameters
Web Application Firewall Rule
allBlock SQL injection patterns in URL parameters
Add WAF rule to detect and block SQL injection attempts in advertiser_status and status_select parameters
🧯 If You Can't Patch
- Disable or remove the com_adagency plugin if not essential
- Implement strict network segmentation and limit database user privileges
🔍 How to Verify
Check if Vulnerable:
Check Joomla! Extension Manager for com_adagency plugin version 6.0.9Check Version:
Check Joomla! admin panel → Extensions → Manage → Search for com_adagencyVerify Fix Applied:
Confirm plugin version is 6.0.10 or later in Extension Manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL injection patterns in advertiser_status/status_select parameters
Network Indicators:
- HTTP requests containing SQL keywords in advertiser_status or status_select parameters
SIEM Query:
source="web_logs" AND (advertiser_status CONTAINS "UNION" OR status_select CONTAINS "SELECT")