CVE-2018-18018 SQL injection in n/a
SQL injection in Slideshow Gallery plugin allows attackers to read or modify database content via gallery parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18018?
CVE-2018-18018 is a critical SQL injection vulnerability in n/a, published on 15 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
Weakness: CWE-89
Which versions are affected by CVE-2018-18018?
It affects 1 product.
Products include Tribulant Slideshow Gallery.
How do I fix CVE-2018-18018?
No fix has been published for CVE-2018-18018 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-18018 being exploited?
There is no known exploitation of CVE-2018-18018 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-28491 WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection
- CVE-2018-18017 Cross-site scripting in n/a
- CVE-2018-18019 Cross-site scripting in n/a
- CVE-2018-17946 Cross-site scripting in n/a
- CVE-2023-28497 WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF)
Sources
Also known as GHSA-xprq-8xww-262w.