PT-2019-15693 · Fudforum · Fudforum

Fuzzlove · Publicado 2019-11-13 · Atualizado 2019-11-15 · CVE-2019-18839

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUDForum version 3.0.9

Description The issue allows for Stored XSS via the nlogin parameter, potentially resulting in remote code execution. An attacker can use a user account to fully compromise the system by sending a POST request. When the admin visits the user information, the payload will execute, enabling the writing of PHP files to the web root and the execution of code on the remote server.

Recommendations For FUDForum version 3.0.9, consider disabling the nlogin parameter as a temporary workaround until a patch is available. Restrict access to user information pages for admins to minimize the risk of exploitation. Avoid using the nlogin parameter in affected API endpoints until the issue is resolved.

Exploit

Correção

RCE

OS Command Injection

XSS

Enumeração de Fraquezas

CWE-78

CWE-79

Identificadores relacionados

CVE-2019-18839

Produtos afetados

Fudforum

Referências · 5

• 🔥 https://github.com/fuzzlove/FUDforum-XSS-RCE · Exploit
• 🔥 https://packetstormsecurity.com/files/155261/FUDForum-3.0.9-Code-Execution-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-18839 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18839 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18839 · Nota