CVE-2018-1999022: Code Injection
PEAR HTMLQuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's setOptions method, HTMLQuickFormelement's findValue method, HTMLQuickFormelement's prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/addpracticetypeid[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1999022?
CVE-2018-1999022 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2018-1999022?
To fix CVE-2018-1999022, upgrade to HTML_QuickForm version 3.2.15 or later, and also ensure CiviCRM is updated to version 5.3.1 or newer.
What are the affected versions for CVE-2018-1999022?
CVE-2018-1999022 affects HTML_QuickForm version 3.2.14 and specific versions of CiviCRM up to 4.6.37 and 5.3.0.
What type of vulnerability is CVE-2018-1999022?
CVE-2018-1999022 is an eval injection vulnerability, which allows for the execution of arbitrary code.
Who is impacted by CVE-2018-1999022?
Developers and organizations using affected versions of HTML_QuickForm or CiviCRM are at risk from CVE-2018-1999022.