2022-04-11 06:44:02 +00:00
id : CVE-2018-7662
info :
2022-05-13 20:26:43 +00:00
name : CouchCMS <= 2.0 - Path Disclosure
2022-04-11 06:44:02 +00:00
author : ritikchaddha
severity : medium
2022-04-22 10:38:41 +00:00
description : CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
2023-09-06 12:57:14 +00:00
remediation : |
Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability.
2022-04-21 21:16:41 +00:00
reference :
- https://github.com/CouchCMS/CouchCMS/issues/46
- https://nvd.nist.gov/vuln/detail/CVE-2018-7662
2022-04-11 20:08:33 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 5.3
2022-04-11 20:08:33 +00:00
cve-id : CVE-2018-7662
cwe-id : CWE-200
2023-07-11 19:49:27 +00:00
epss-score : 0.00286
2023-10-19 10:38:59 +00:00
epss-percentile : 0.6514
2023-09-06 12:57:14 +00:00
cpe : cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : couchcms
product : couch
tags : couchcms,fpd,cve,cve2018
2022-04-11 06:44:02 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-04-11 06:44:02 +00:00
- method : GET
path :
- "{{BaseURL}}/includes/mysql2i/mysql2i.func.php"
- "{{BaseURL}}/addons/phpmailer/phpmailer.php"
2022-04-11 19:52:14 +00:00
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2022-04-11 10:33:57 +00:00
matchers-condition : or
2022-04-11 06:44:02 +00:00
matchers :
- type : word
2022-04-11 10:33:57 +00:00
part : body
2022-04-11 06:44:02 +00:00
words :
- "mysql2i.func.php on line 10"
- "Fatal error: Cannot redeclare mysql_affected_rows() in"
2022-04-11 10:33:57 +00:00
condition : and
- type : word
part : body
words :
2022-04-11 06:44:02 +00:00
- "phpmailer.php on line 10"
- "Fatal error: Call to a menber function add_event_listener() on a non-object in"
2022-04-11 10:33:57 +00:00
condition : and
2023-10-19 13:13:52 +00:00
# digest: 4b0a004830460221009d4db290eff9ff3f9fab288930b82cb8d1b4e28324a4d26ac5014c97d5710e54022100f833dfa1b81cae5c415695e044c663a1cf7bddeeaeffabd88261623ff17b7252:922c64590222798bb761d5b6d8e72950