CVE-2018-19126
CRITICALPrestaShop 1.6.0.1-1.6.1.22 - Unauthenticated Arbitrary File Upload and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-19126. PoCs published by Fariskhi Vidyan, farisv.
AI-analyzed exploit summary This exploit chains multiple vulnerabilities in PrestaShop to achieve remote code execution via deserialization of a malicious PHAR file. It leverages file upload and directory manipulation to trigger the payload.
Description
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
Exploits (2)
This exploit chains multiple vulnerabilities in PrestaShop to achieve remote code execution via deserialization of a malicious PHAR file. It leverages file upload and directory manipulation to trigger the payload.
This repository contains a functional exploit for CVE-2018-19126, which chains multiple vulnerabilities in PrestaShop to achieve remote code execution via phar deserialization. The exploit automates the process of uploading a malicious phar file, renaming the upload directory, and triggering deserialization.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H