PT-2018-10253 · Phprap · Phprap

Published 2018-05-14 · Updated 2018-06-19 · CVE-2018-11031

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPRAP versions 1.0.4 through 1.0.8

Description The issue concerns a Server-Side Request Forgery (SSRF) vulnerability. It can be exploited via the /debug URI by sending a POST request with specific parameters, such as api[url]=file:////etc/passwd and api[method]=get. This allows an attacker to access internal resources.

Recommendations For PHPRAP versions 1.0.4 through 1.0.8, as a temporary workaround, consider disabling access to the /debug URI until a patch is available. Restrict the use of the api[url] and api[method] parameters in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2018-11031

Affected Products

Phprap

References · 3

• 🔥 https://github.com/gouguoyin/phprap/issues/89 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11031 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11031 · Vendor Advisory