Описание
Subrion CMS RCE Vulnerability
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2018-19422
- https://github.com/intelliants/subrion/issues/801
- https://github.com/intelliants/subrion/commit/74359bcfaea424edda6d782a8ac25397c55972ab
- http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html
- http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html
Пакеты
Наименование
intelliants/subrion
composer
Затронутые версииВерсия исправления
<= 4.2.1
4.2.2
Связанные уязвимости
CVSS3: 7.2
nvd
около 7 лет назад
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.