PT-2018-3689 · Php · Php-Proxy

0Xuhaw · Published 2018-11-30 · Updated 2022-05-13 · CVE-2018-19784

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Proxy version 5.1.0

Description The issue is related to the str rot pass function in PHP-Proxy, which uses weak cryptography. This weakness makes it easier for attackers to calculate the authorization data needed for local file inclusion. The vulnerability is also associated with unauthorized access to encryption keys, allowing a remote attacker to disclose protected information.

Recommendations For PHP-Proxy version 5.1.0, consider disabling the str rot pass function as a temporary workaround until a patch is available. Restrict access to sensitive data and encryption keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2021-03194

CVE-2018-19784

GHSA-4WGF-9X5R-P938

Affected Products

Php-Proxy

References · 8

• 🔥 https://github.com/Athlon1600/php-proxy-app/issues/139 · Exploit
• 🔥 https://github.com/0xUhaw/CVE-Bins/tree/master/PHP-Proxy · Exploit
• 🔥❌ https://github.com/eddietcc/CVE-Bins/blob/master/PHP-Proxy/readme.md · Exploit, Deleted
• https://osv.dev/vulnerability/GHSA-4wgf-9x5r-p938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19784 · Security Note
• https://bdu.fstec.ru/vul/2021-03194 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19784 · Vendor Advisory
• https://github.com/Athlon1600/php-proxy · Note