CVE-2018-6843 : Security Advisory and Response

Kentico 10 before 10.0.50 and Kentico 11 before 11.0.3 are vulnerable to SQL injection attacks in the administration interface.

Understanding CVE-2018-6843

The versions of Kentico 10 and 11 have a security vulnerability that allows SQL injection attacks.

What is CVE-2018-6843?

This CVE identifies a SQL injection vulnerability in Kentico versions 10 and 11, specifically in the administration interface.

The Impact of CVE-2018-6843

The vulnerability can be exploited by attackers to execute malicious SQL queries, potentially leading to data theft, manipulation, or unauthorized access.

Technical Details of CVE-2018-6843

Kentico versions 10 and 11 are susceptible to SQL injection attacks in the administration interface.

Vulnerability Description

The vulnerability allows attackers to inject malicious SQL queries through the administration interface.

Affected Systems and Versions

Kentico 10 versions prior to 10.0.50
Kentico 11 versions prior to 11.0.3

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting SQL commands through the affected administration interface.

Mitigation and Prevention

To address CVE-2018-6843, follow these steps:

Immediate Steps to Take

Update Kentico to version 10.0.50 or 11.0.3, which contain fixes for the SQL injection vulnerability.
Monitor system logs for any suspicious activity that may indicate exploitation.

Long-Term Security Practices

Regularly update and patch Kentico installations to prevent known vulnerabilities.
Implement input validation and parameterized queries to mitigate SQL injection risks.

Patching and Updates

Apply security patches provided by Kentico promptly to address vulnerabilities and enhance system security.