CVE-2018-6365
📋 TL;DR
CVE-2018-6365 is a critical SQL injection vulnerability in TSiteBuilder 1.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in multiple PHP files. This affects all users running TSiteBuilder 1.0 without proper input validation. Successful exploitation could lead to complete database compromise.
💻 Affected Systems
- TSiteBuilder
📦 What is this software?
Tsitebuilder by Datacomponents
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution through database functions.
Likely Case
Database information disclosure, authentication bypass, and data manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Multiple public exploit scripts are available. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for all id parameters.
Modify site.php, pagelist.php, and page_new.php to use prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns.
Add WAF rules to detect and block SQL injection attempts
🧯 If You Can't Patch
- Implement network segmentation to isolate TSiteBuilder from critical systems
- Deploy intrusion detection systems to monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test the id parameter in /site.php, /pagelist.php, or /page_new.php with SQL injection payloads like ' OR '1'='1Check Version:
Check TSiteBuilder configuration files or admin panel for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer work and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed parameter requests with SQL syntax
Network Indicators:
- HTTP requests containing SQL keywords to vulnerable endpoints
- Unusual database query patterns
SIEM Query:
source="web_logs" AND (uri="/site.php" OR uri="/pagelist.php" OR uri="/page_new.php") AND (request CONTAINS "UNION" OR request CONTAINS "SELECT" OR request CONTAINS "OR '1'='1'")