CVE-2018-10197

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes it possible to read all database content. The vulnerability exists in the ticket HTTP GET parameter. For example, one can succeed in reading the password hash of the administrator user in the "userdata" table from the "eloam" database.

• CWE-89

• http://seclists.org/fulldisclosure/2018/Jul/29Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/Jul/29Exploit, Mailing List, Third Party Advisory

Published

Jul 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10191In versions of mruby up to and including 1.4.0, an integer o…9.8
• CVE-2018-10192IPVanish 3.0.11 for macOS suffers from a root privilege esca…
• CVE-2018-10193LogMeIn LastPass through 4.15.0 allows remote attackers to c…
• CVE-2018-10194The set_text_distance function in devices/vector/gdevpdts.c …
• CVE-2018-10195lrzsz before version 0.12.21~rc can leak information to the …7.1
• CVE-2018-10196NULL pointer dereference vulnerability in the rebuild_vlists…
• CVE-2018-10198An issue was discovered in OTRS 6.0.x before 6.0.7. An attac…
• CVE-2018-10199In versions of mruby up to and including 1.4.0, a use-after-…
• CVE-2018-1020A remote code execution vulnerability exists when Internet E…
• CVE-2018-10201An issue was discovered in NcMonitorServer.exe in NC Monitor…
• CVE-2018-10204PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege es…
• CVE-2018-10205hyperstart 1.0.0 in HyperHQ Hyper has memory leaks in the co…