CVE-2018-19422: Malicious File Upload

Q: What is CVE-2018-19422?

CVE-2018-19422 is a vulnerability in Subrion CMS 4.2.1 that allows remote attackers to execute arbitrary PHP code via a .pht or .phar file.

Q: How does the vulnerability in Subrion CMS 4.2.1 occur?

The vulnerability occurs in the /panel/uploads directory and is caused by the .htaccess file omitting .pht and .phar files.

Q: What is the severity of CVE-2018-19422?

The severity of CVE-2018-19422 is high, with a severity value of 7.2.

Q: What software is affected by CVE-2018-19422?

Subrion CMS 4.2.1 and Intelliants Subrion CMS are affected by CVE-2018-19422.

Q: How can I fix CVE-2018-19422?

To fix CVE-2018-19422, update Subrion CMS to version 4.2.2 or higher.

Published Nov 21, 2018

Updated

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Other sources

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Affected Software

2 affected componentsFixes available

composer/intelliants/subrion<=4.2.1

4.2.2

Intelliants Subrion CMS=4.2.1

Event History

Nov 21, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

May 13, 2022

Advisory Published

01:10 AM

Frequently Asked Questions

What is CVE-2018-19422?

CVE-2018-19422 is a vulnerability in Subrion CMS 4.2.1 that allows remote attackers to execute arbitrary PHP code via a .pht or .phar file.

How does the vulnerability in Subrion CMS 4.2.1 occur?

The vulnerability occurs in the /panel/uploads directory and is caused by the .htaccess file omitting .pht and .phar files.

What is the severity of CVE-2018-19422?

The severity of CVE-2018-19422 is high, with a severity value of 7.2.

What software is affected by CVE-2018-19422?