# CVE-2018-11511: ASUSTOR ADM - SQLi

> Live exploitation tracking for CVE-2018-11511 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-11511

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ASUSTOR ADM
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** nas

## Description

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.

## CrowdSec analysis

[CVE-2018-11511](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-11511) is a critical SQL injection vulnerability in the tree list functionality of the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3, affecting the 'album_id' or 'scope' parameters. This flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands via crafted requests, potentially leading to data theft, unauthorized access, or full compromise of the underlying database.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2018-11511 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2018-11511. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit endpoints such as `/photo-gallery/api/album/tree_lists/` and `/photo-gallery/api/photo/search/` by injecting SQL commands into the `album_id` and `scope` parameters, respectively, to execute unauthorized database queries.

## Timeline

- 2018-08-16: CVE Published. CVE-2018-11511 is published to NVD.
- 2025-10-15: Rule Released. CrowdSec releases a rule to detect CVE-2018-11511 exploitation attempts against the CrowdSec Network.
- 2025-10-17: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2018-11511 for the first time.

## References

- http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11511.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-11511) follows observed exploitation activity for CVE-2018-11511. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.