PT-2018-15201 · Pear · Html Quickform

Patrick Figel · Published 2018-07-23 · Updated 2019-01-23 · CVE-2018-1999022

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PEAR HTML QuickForm versions 3.2.14 and earlier

Description The issue concerns an eval injection that can lead to possible information disclosure, impact on data integrity, and execution of arbitrary code. This can be exploited via a specially crafted query string, for example, a malicious URL that injects unauthorized code. The getSubmitValue method, validate method, setOptions method, findValue method, and prepareValue method in HTML QuickForm, HTML QuickForm hierselect, and HTML QuickForm element are affected.

Recommendations For PEAR HTML QuickForm version 3.2.14 and earlier, update to version 3.2.15 to resolve the issue. As a temporary workaround, consider restricting access to the getSubmitValue, validate, setOptions, findValue, and prepareValue methods until the update is applied. Avoid using specially crafted query strings that could exploit the eval injection vulnerability.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-1999022

MGASA-2019-0049

Affected Products

Html Quickform

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1999022 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1999022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1999022 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1999022 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0049.html · Security Note
• http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1999022 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1999022 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999022 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999022 · Note
• https://bugs.mageia.org/show_bug.cgi?id=24185 · Note
• https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform · Note