CVE-2018-19422

EUVD-2022-2907 · Published May 13, 2022

Subrion CMS RCE Vulnerability `/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Technologies

Intelliants Subrion CmsIntelliants Subrion

Weaknesses

CWE-434

CVSS scores

v3.17.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth

T1190Exploit Public-Facing Application T1574.010Services File Permissions Weakness

References

http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html
http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html
https://github.com/intelliants/subrion/issues/801
https://nvd.nist.gov/vuln/detail/CVE-2018-19422
https://github.com/intelliants/subrion/commit/74359bcfaea424edda6d782a8ac25397c55972ab

Potentially impacted assets

See if this affects your attack surface