PT-2018-14891 · Php · Php-Proxy

Ameer Pornillos · Published 2018-11-13 · Updated 2022-05-14 · CVE-2018-19246

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Proxy version 5.1.0

Description The issue allows remote attackers to read local files if the default "pre-installed version" is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.

Recommendations For PHP-Proxy version 5.1.0, consider changing the default app key value in the config.php file to prevent unauthorized access. As a temporary workaround, restrict access to sensitive local files until a more permanent solution is implemented.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-19246

GHSA-PC5H-M95G-V6RH

Affected Products

Php-Proxy

References · 6

• 🔥 https://github.com/Athlon1600/php-proxy-app/issues/134 · Exploit
• 🔥 https://exploit-db.com/exploits/45861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19246 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19246 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pc5h-m95g-v6rh · Vendor Advisory
• https://github.com/Athlon1600/php-proxy/pull/126 · Note