PT-2018-14891 · Php · Php-Proxy

Ameer Pornillos · Publicado 2018-11-13 · Atualizado 2022-05-14 · CVE-2018-19246

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Proxy version 5.1.0

Description The issue allows remote attackers to read local files if the default "pre-installed version" is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.

Recommendations For PHP-Proxy version 5.1.0, consider changing the default app key value in the config.php file to prevent unauthorized access. As a temporary workaround, restrict access to sensitive local files until a more permanent solution is implemented.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-19246

GHSA-PC5H-M95G-V6RH

Produtos afetados

Php-Proxy

Referências · 6

• 🔥 https://github.com/Athlon1600/php-proxy-app/issues/134 · Exploit
• 🔥 https://exploit-db.com/exploits/45861 · Exploit
• https://github.com/Athlon1600/php-proxy/pull/126 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19246 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19246 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pc5h-m95g-v6rh · Aviso do Fabricante