CVE-2018-18251 SQL injection in n/a
Authenticated attackers can execute arbitrary SQL statements via a custom RPC protocol, potentially leading to remote code execution or data compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18251?
CVE-2018-18251 is a critical SQL injection vulnerability in n/a, published on 24 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on the client binary to enforce security rules and integrity of SQL statements and other content being sent to the server. Client HTTP calls can be manipulated by one of several means to execute arbitrary SQL statements (similar to SQLi) or possibly have unspecified other impact via this custom protocol. To perform these attacks an authenticated session is first required. In some cases client calls are obfuscated by encryption, which can be bypassed due to hard-coded keys and an insecure key rotation protocol. Impacts may include remote code execution in some deployments; however, the vendor states that this cannot occur when the installation documentation is heeded.
Which versions are affected by CVE-2018-18251?
It affects 1 product.
Products include Deltek Vision.
How do I fix CVE-2018-18251?
No fix has been published for CVE-2018-18251 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-18251 being exploited?
There is no known exploitation of CVE-2018-18251 in the wild and no public exploit code.
Sources
Also known as GHSA-7r2g-9ch4-c2hp.