PT-2018-3689 · Php · Php-Proxy

0Xuhaw · Publicado 2018-11-30 · Atualizado 2022-05-13 · CVE-2018-19784

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Proxy version 5.1.0

Description The issue is related to the str rot pass function in PHP-Proxy, which uses weak cryptography. This weakness makes it easier for attackers to calculate the authorization data needed for local file inclusion. The vulnerability is also associated with unauthorized access to encryption keys, allowing a remote attacker to disclose protected information.

Recommendations For PHP-Proxy version 5.1.0, consider disabling the str rot pass function as a temporary workaround until a patch is available. Restrict access to sensitive data and encryption keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

BDU:2021-03194

CVE-2018-19784

GHSA-4WGF-9X5R-P938

Produtos afetados

Php-Proxy

Referências · 8

• 🔥 https://github.com/Athlon1600/php-proxy-app/issues/139 · Exploit
• 🔥 https://github.com/0xUhaw/CVE-Bins/tree/master/PHP-Proxy · Exploit
• 🔥❌ https://github.com/eddietcc/CVE-Bins/blob/master/PHP-Proxy/readme.md · Exploit, Deleted
• https://github.com/Athlon1600/php-proxy · Nota
• https://osv.dev/vulnerability/GHSA-4wgf-9x5r-p938 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19784 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-03194 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19784 · Aviso do Fabricante