CVE-2018-17552: Navigate CMS login.php SQL injection authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable authentication bypass with public exploit code and a 9.8 CVSS score, tempered only by the absence of a KEV listing.

What it is

Navigate CMS 2.8 contains a SQL injection flaw in login.php reachable through the navigate-user cookie. Because the injection sits in the authentication path, an attacker can bypass login entirely and reach the CMS administrative interface. The record does not list affected versions beyond 2.8, and no vendor statement on later releases is provided.

Impact

An unauthenticated attacker gains administrative access to the CMS, which typically means control over site content, users and configuration. The CVSS vector rates confidentiality, integrity and availability impact as high, so full compromise of the application is the expected outcome.

Attack surface

The flaw is network reachable via HTTP against login.php, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The injection point is the navigate-user cookie, so the attacker only needs to send a crafted cookie value to the login endpoint.

Exploitation

Public exploit code exists, including a Metasploit module and an Exploit-DB entry, and EPSS is very high at 0.84 (99.7th percentile). The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild record in this dataset.

What to do

• Apply the vendor patch commit 6df73ccca64253a5e81c23356943fae50ffc836f or upgrade to a Navigate CMS release that includes it.
• If patching is not immediately possible, restrict access to login.php and the CMS admin interface to trusted networks or a VPN.
• Place the CMS behind a WAF or reverse proxy with rules that inspect and reject SQL metacharacters in the navigate-user cookie.
• Rotate CMS administrator credentials and review accounts for unauthorized additions after any suspected exposure.
• Monitor vendor channels for confirmation of which versions beyond 2.8 are affected, since the record does not state this.

Detection

• Alert on SQL keywords, quotes or comment sequences in the navigate-user cookie value in web server or WAF logs.
• Hunt for login.php requests that return success or admin session cookies without a preceding valid credential exchange.
• Review CMS audit logs for administrative actions or account creation from unexpected source IPs.
• Correlate web logs with the known Metasploit and Exploit-DB payload patterns for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.