What’s Vulnerable › Vulnerabilities

CVE-2018-5384: Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-24 · updated 2026-06-17
• Weakness: CWE-89

Description

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.

Affected products

• Navarino Infinity: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: Navarino Infinity 2.2. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/103544
• https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3
• https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
• https://www.kb.cert.org/vuls/id/184077
• http://www.securityfocus.com/bid/103544
• https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3
• https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
• https://www.kb.cert.org/vuls/id/184077

Get alerted when CVE-2018-5384 or the next vulnerability affects your stack