PT-2018-12685 · Responsive Filemanager · Responsive Filemanager

Guia Brahim Fouad · Published 2018-08-03 · Updated 2019-06-17 · CVE-2018-14728

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Responsive FileManager version 9.13.1

Description The issue allows for Server-Side Request Forgery (SSRF) via the url parameter in the upload.php file.

Recommendations For Responsive FileManager version 9.13.1, consider restricting access to the upload.php file or the url parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the url parameter in the upload.php file until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2018-14728

Affected Products

Responsive Filemanager

References · 4

• 🔥 https://exploit-db.com/exploits/45103 · Exploit
• 🔥 http://packetstormsecurity.com/files/148742/Responsive-Filemanager-9.13.1-Server-Side-Request-Forgery.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-14728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14728 · Security Note