CVE-2018-6582
📋 TL;DR
This vulnerability allows SQL injection attacks in Joomla! websites using the Zh GoogleMap component. Attackers can execute arbitrary SQL commands through the id parameter in specific requests, potentially compromising the database. All Joomla! sites running Zh GoogleMap version 8.4.0.0 are affected.
💻 Affected Systems
- Joomla! Zh GoogleMap component
📦 What is this software?
Zh Googlemap by Zh Googlemap Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion, and potential remote code execution through database functions.
Likely Case
Database information disclosure, authentication bypass, or data manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.0.1 or later
Vendor Advisory: https://extensions.joomla.org/extension/zh-googlemap/
Restart Required: No
Instructions:
1. Update Zh GoogleMap component to version 8.4.0.1 or later via Joomla! Extension Manager. 2. Verify the update completed successfully. 3. Test component functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter id parameter to numeric values only
Modify component PHP files to add: if(!is_numeric($id)) { die('Invalid input'); }
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL injection attempts in id parameter
🧯 If You Can't Patch
- Disable the Zh GoogleMap component entirely
- Implement strict network access controls to limit component exposure
🔍 How to Verify
Check if Vulnerable:
Check Joomla! Extension Manager for Zh GoogleMap version. If version is 8.4.0.0, system is vulnerable.Check Version:
Check Joomla! admin panel → Extensions → Manage → ManageVerify Fix Applied:
Confirm Zh GoogleMap version is 8.4.0.1 or later in Extension Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL injection patterns in id parameter
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL keywords in id parameter
- Unusual traffic patterns to Zh GoogleMap endpoints
SIEM Query:
source="web_logs" AND (id="*OR*" OR id="*UNION*" OR id="*SELECT*" OR id="*INSERT*" OR id="*UPDATE*" OR id="*DELETE*")