CVE-2018-19246

HIGH

LFI in PHP-Proxy 5.1.0

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-19246 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit.

Description

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

athlon1600/php-proxy

Browse Packagist / athlon1600/php-proxy
GitHub AdvisoryThrough 5.1.0affected

Proofs of concept

1

Catalogued exploits

ExploitDBPHP-Proxy 5.1.0 - Local File InclusionExploitDB exploitby Ameer PornillosNot analyzed1 file
ExploitDB
PoC details

References

4