CVE-2018-1999022: Code Injection
First published: Mon Jul 23 2018(Updated: )
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HTML QuickForm | =3.2.14 | |
| CiviCRM | <=4.6.37 | |
| CiviCRM | =5.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-1999022?
CVE-2018-1999022 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2018-1999022?
To fix CVE-2018-1999022, upgrade to HTML_QuickForm version 3.2.15 or later, and also ensure CiviCRM is updated to version 5.3.1 or newer.
What are the affected versions for CVE-2018-1999022?
CVE-2018-1999022 affects HTML_QuickForm version 3.2.14 and specific versions of CiviCRM up to 4.6.37 and 5.3.0.
What type of vulnerability is CVE-2018-1999022?
CVE-2018-1999022 is an eval injection vulnerability, which allows for the execution of arbitrary code.
Who is impacted by CVE-2018-1999022?
Developers and organizations using affected versions of HTML_QuickForm or CiviCRM are at risk from CVE-2018-1999022.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/html quickform project
- canonical/html quickform
- version/html quickform/3.2.14
- vendor/civicrm
- canonical/civicrm
- version/civicrm/4.6.37
- version/civicrm/5.3.0