CVE-2018-6368
📋 TL;DR
This CVE describes a SQL injection vulnerability in the JomEstate PRO component for Joomla! CMS. Attackers can exploit the 'id' parameter in 'task=detailed' actions to execute arbitrary SQL commands, potentially compromising the database. All Joomla! sites using vulnerable versions of JomEstate PRO are affected.
💻 Affected Systems
- JomEstate PRO for Joomla!
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential privilege escalation to full system access; possible remote code execution through database functions.
Likely Case
Database information disclosure (user credentials, sensitive data), data manipulation, and potential site defacement.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 3.7
Vendor Advisory: https://extensions.joomla.org/extension/jomestate-pro/
Restart Required: No
Instructions:
1. Log into Joomla! admin panel
2. Navigate to Extensions > Manage > Update
3. Update JomEstate PRO to latest version
4. Alternatively, download latest version from vendor and install via Extensions > Install
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
Modify component PHP files to add: $id = (int)$_GET['id']; or use Joomla! JInput filtering
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL keywords in 'id' parameter for JomEstate URLs
🧯 If You Can't Patch
- Disable or remove JomEstate PRO component entirely
- Restrict access to vulnerable endpoints using .htaccess or web server configuration
🔍 How to Verify
Check if Vulnerable:
Check Joomla! admin panel > Extensions > Manage > Manage for JomEstate PRO version. If version is 3.7 or earlier, system is vulnerable.Check Version:
Check Joomla! admin panel or examine /administrator/components/com_jomestate/jomestate.xml file version tagVerify Fix Applied:
After update, verify JomEstate PRO version is above 3.7. Test vulnerable endpoint with SQL injection payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in Joomla! logs
- Multiple requests with SQL keywords in 'id' parameter
- Requests to index.php?option=com_jomestate&task=detailed&id= with suspicious payloads
Network Indicators:
- HTTP requests containing SQL injection patterns in query strings
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*com_jomestate*" AND (query="*task=detailed*" AND (query="*id=*SELECT*" OR query="*id=*UNION*" OR query="*id=*OR*"))