CVE-2018-12984 -- Hycus CMS 1.0.4 Authentication Bypass POC

CVE-2018-12984

A vulnerability was found in Hycus CMS 1.0.4. It has been rated as critical. Affected by this issue is an unknown function. The manipulation with the input value '=' 'OR' leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. Impacted is confidentiality, integrity, and availability. An attacker might be able inject and/or alter existing SQL statements which would influence the database exchange.

The weakness was released 06/29/2018 as EDB-ID 44954 as uncorroborated exploit. The advisory is available at exploit-db.com. This vulnerability is handled as CVE-2018-12984 since 06/28/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db → https://www.exploit-db.com/exploits/44954/

Видео CVE-2018-12984 -- Hycus CMS 1.0.4 Authentication Bypass POC канала T3raByt3