What’s Vulnerable › Vulnerabilities

CVE-2018-10197

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-11 · updated 2026-06-17
• Weakness: CWE-89

Description

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes it possible to read all database content. The vulnerability exists in the ticket HTTP GET parameter. For example, one can succeed in reading the password hash of the administrator user in the "userdata" table from the "eloam" database.

Affected products

• Elo Access Manager: before 9.18.040; from 10.0.0 (excl.) before 10.18.040 — fixed in 10.18.040, 9.18.040

How to fix

Upgrade to a fixed version: Elo Access Manager 10.18.040, 9.18.040. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2018/Jul/29
• http://seclists.org/fulldisclosure/2018/Jul/29

Get alerted when CVE-2018-10197 or the next vulnerability affects your stack