CVE-2018-3814: Malicious File Upload

Q: What is CVE-2018-3814?

CVE-2018-3814 is a vulnerability in Craft CMS 2.6.3000 that allows remote attackers to execute arbitrary PHP code.

Q: How can the CVE-2018-3814 vulnerability be exploited?

The vulnerability can be exploited by using the "Assets->Upload files" screen and then the "Replace it" option to upload a .jpg file with embedded PHP code and rename it to a .php extension.

Published Jan 1, 2018

Updated

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

Affected Software

2 affected components

composer/craftcms/cms<=2.6.3000

Craft CMS=2.6.3000

Event History

Jan 1, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

May 13, 2022

Advisory Published

via GitHub·01:20 AM

Frequently Asked Questions

What is CVE-2018-3814?

CVE-2018-3814 is a vulnerability in Craft CMS 2.6.3000 that allows remote attackers to execute arbitrary PHP code.

How can the CVE-2018-3814 vulnerability be exploited?

The vulnerability can be exploited by using the "Assets->Upload files" screen and then the "Replace it" option to upload a .jpg file with embedded PHP code and rename it to a .php extension.

What is the severity of CVE-2018-3814?

CVE-2018-3814 has a severity rating of 8.8 (high).

How can I fix the CVE-2018-3814 vulnerability?

To fix the vulnerability, you should update Craft CMS to a version higher than 2.6.3000 that includes a patch for this vulnerability.

Where can I find more information about CVE-2018-3814?

You can find more information about CVE-2018-3814 at the following reference: [Link](https://github.com/Snowty/myCVE/blob/master/CraftCMS-2.6.3000/README.md)