CVE-2018-6605 Scanner

Joomla! is a widely used content management system (CMS) known for its flexibility and extensibility, allowing it to be customized through a variety of components and plugins such as Zh BaiduMap, which integrates Baidu map functionality. This component is particularly popular among developers and site owners who want to integrate dynamic maps into their Joomla! websites, especially those catering to Chinese audiences who prefer Baidu over other mapping services. Zh BaiduMap 3.0.0.1, however, has been identified to have a specific security weakness making it vulnerable to SQL Injection, a common attack vector used by hackers to compromise a database. This vulnerability makes it critical for administrators to ensure their systems are updated with the necessary patches. Regular updates are advisable to maintain the security and integrity of Joomla! installations and their components.

The SQL Injection vulnerability targeted by this scan involves injecting malicious SQL commands into the application's query via the id parameter. This vulnerability is classified as critical due to the potential for attackers to exploit it and gain unauthorized access to the database. SQL Injection can modify or disclose sensitive data, potentially leading to a full compromise of the affected Joomla! site. Ensuring all input is sanitized and validated is a key defense against such vulnerabilities. Web application firewalls can provide an additional layer of protection by detecting and blocking malicious requests.

In technical terms, the vulnerability arises from the failure of the component to correctly handle and sanitize user-inputted data in the id parameter. This parameter, when improperly handled, allows attackers to execute arbitrary SQL commands within the context of the Joomla! database. The vulnerability can be triggered through several tasks including getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails requests. Detecting this vulnerability requires attempts to verify the existence of exploitable SQL commands that could lead to database manipulation.

If exploited, this SQL Injection vulnerability could result in unauthorized disclosure of sensitive site data, including user credentials and personal information. More severe outcomes could include deletion or modification of database entries, leading to site defacement or malfunction. In the worst-case scenario, attackers could leverage this to gain administrative access to the Joomla! instance, perform privilege escalation, or install backdoors for persistent access.

REFERENCES

• https://github.com/C0reL0ader/EaST/blob/master/exploits/efa_joomla_zh_baidumap_sqli.py
• https://www.exploit-db.com/exploits/43974