CVE-2018-11535

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/NinjaXshell/f894bd79f9707a92a7b6934711a8fdc9Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44793/Exploit, Third Party Advisory, VDB Entry
https://gist.github.com/NinjaXshell/f894bd79f9707a92a7b6934711a8fdc9Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44793/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-115369.8md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.CVE-2018-115376.5Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of th CVE-2018-115388.8servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR CVE-2018-11548.8In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of CVE-2018-115419.8A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privil CVE-2018-115429.8A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arb CVE-2018-115437.5A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbit CVE-2018-115449.8The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/dat CVE-2018-115459.8md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely o CVE-2018-115469.8md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.CVE-2018-115479.8md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.CVE-2018-115487.5An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same sou