Advisory details:
github_osv / GHSA-73xj-v6gc-g5p5
| Advisory ID | github_osv/GHSA-73xj-v6gc-g5p5 |
| Aliases |
CVE-2018-19422
|
| Summary | Subrion CMS RCE Vulnerability `/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.5 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-73xj-v6gc-g5p5/GHSA-73xj-v6gc-g5p5.json |
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | This module exploits an authenticated file upload vulnerability in Subrion CMS versions 4.2.1 and lower. The vulnerability is caused by the .htaccess file not preventing the execution of .pht, .phar, and .xhtml files. Files with these extensions are not included in the .htaccess blacklist, hence these files can be uploaded and executed to achieve remote code execution. In this module, a .phar file with a randomized name is uploaded and executed to receive a Meterpreter session on the target, then deletes itself afterwards. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Nov. 4, 2018 |
| Platform | PHP |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/subrion_cms_file_upload_rce.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | May 17, 2021 |
| Description | Subrion CMS 4.2.1 - Arbitrary File Upload |
| Ransomware campaign use | Unknown |
| Source publication date | May 17, 2021 |
| Exploit type | webapps |
| Platform | php |
| Source update date | Oct. 29, 2021 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.