CVE-2018-14058

Related Files

Pimcore Gather Credentials via SQL Injection

Posted Aug 31, 2024

Authored by Shelby Pace, N. Rai-Ngoen, Thongchai Silpavarangkura | Site metasploit.com

This Metasploit module extracts the usernames and hashed passwords of all users of the Pimcore web service by exploiting a SQL injection vulnerability in Pimcores REST API. Pimcore begins to create password hashes by concatenating a users username, the name of the application, and the users password in the format USERNAME:pimcore:PASSWORD. The resulting string is then used to generate an MD5 hash, and then that MD5 hash is used to create the final hash, which is generated using PHPs built-in password_hash function.

tags | exploit, web, php, sql injection

advisories | CVE-2018-14058

SHA-256 | a1fac0dca0eb708a1348babebd5e4be27016a27680c8d2967d94171f313a98ca

Download | Favorite | View

Pimcore 5.2.3 CSRF / Cross Site Scripting / SQL Injection

Posted Aug 16, 2018

Authored by T. Silpavarangkura, N. Rai-Ngoen | Site sec-consult.com

Pimcore versions 5.2.3 and below suffer from cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection, csrf

advisories | CVE-2018-14057, CVE-2018-14058, CVE-2018-14059

SHA-256 | aba5d313c5fdfdbdc045ef60b644c928c5b431384880c30e65d8e7dc0393c95b

Download | Favorite | View