CVE-2018-19422 : /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Published 2018-11-21 21:29:00

Updated 2023-08-04 18:15:10

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2018-19422

Intelliants » Subrion Cms » Version: 4.2.1
cpe:2.3:a:intelliants:subrion_cms:4.2.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-19422

EPSS FAQ

85.53%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-19422

Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE

Disclosure Date: 2018-11-04

First seen: 2023-09-11

exploit/multi/http/subrion_cms_file_upload_rce

This module exploits an authenticated file upload vulnerability in Subrion CMS versions 4.2.1 and lower. The vulnerability is caused by the .htaccess file not preventing the execution of .pht, .phar, and .xhtml files. Files with these extensions are not inclu

More information

CVSS scores for CVE-2018-19422

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-19422

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-19422

http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html

Subrion CMS 4.2.1 Shell Upload ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/intelliants/subrion/issues/801

Subrion allows to upload pht, phar extensions. · Issue #801 · intelliants/subrion · GitHub
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html

Intelliants Subrion CMS 4.2.1 Remote Code Execution ≈ Packet Storm

Jump to