CVE-2018-12912

HIGH

HongCMS 3.0.0 - SQL Injection via Database Empty Table URI Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-12912. PoCs published by Hzllaga.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in HongCMS 3.0.0 via the 'tablename' parameter in the admin database operation endpoint. The payload uses MySQL's UPDATEXML function to extract database version information.

Description

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Hzllaga · textwebappsphp
https://www.exploit-db.com/exploits/44953

This exploit demonstrates a SQL injection vulnerability in HongCMS 3.0.0 via the 'tablename' parameter in the admin database operation endpoint. The payload uses MySQL's UPDATEXML function to extract database version information.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: HongCMS 3.0.0
Auth required
Prerequisites: Access to admin panel · Valid admin session
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44953/
Third Party Advisory x_refsource_misc
https://github.com/Neeke/HongCMS/issues/4

Scores

CVSS v3 7.2
EPSS 0.0268
EPSS Percentile 84.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
hongcms_project/hongcms 3.0.0
Published Jun 27, 2018
Tracked Since Feb 18, 2026