CVE-2018-6605
📋 TL;DR
This SQL injection vulnerability in the Zh BaiduMap Joomla! component allows attackers to execute arbitrary SQL commands via the id parameter in specific API requests. All Joomla! websites using the vulnerable Zh BaiduMap component version are affected, potentially leading to complete database compromise.
💻 Affected Systems
- Zh BaiduMap component for Joomla!
📦 What is this software?
Zh Baidumap by Zh Baidumap Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Database information disclosure, authentication bypass, and privilege escalation leading to administrative access.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication. Simple SQL injection techniques work.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0.2 or later
Vendor Advisory: https://extensions.joomla.org/extension/zh-baidumap/
Restart Required: No
Instructions:
1. Update Zh BaiduMap component to version 3.0.0.2 or later via Joomla! Extension Manager. 2. Verify the update completed successfully. 3. Test the component functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the id parameter before processing
Modify component PHP files to add: $id = (int)$id; before SQL queries
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in id parameter
🧯 If You Can't Patch
- Disable the Zh BaiduMap component entirely via Joomla! Extension Manager
- Implement strict network segmentation and firewall rules to limit access to affected systems
🔍 How to Verify
Check if Vulnerable:
Check Joomla! Extension Manager for Zh BaiduMap component version 3.0.0.1Check Version:
Check via Joomla! admin panel: Extensions → Manage → Search for 'Zh BaiduMap'Verify Fix Applied:
Verify component version shows 3.0.0.2 or later in Joomla! Extension Manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in Joomla! logs
- Multiple requests to getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails endpoints with suspicious id parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in id parameter
- Unusual database query patterns from web server
SIEM Query:
source="joomla_logs" AND ("getPlacemarkDetails" OR "getPlacemarkHoverText" OR "getPathHoverText" OR "getPathDetails") AND id=*