CVE-2018-19458

HIGH NUCLEI

PHP Proxy 3.0.3 - Info Disclosure

Title source: llm

Description

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.

Exploits (1)

exploitdb WORKING POC

by AkkuS · pythonwebappsphp

https://www.exploit-db.com/exploits/45780

View Code ZIP pw:eip

Nuclei Templates (1)

PHP Proxy 3.0.3 - Local File Inclusion

HIGHby daffainfo

References (2)

[Exploit, Third Party Advisory] https://pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/45780/

Scores

CVSS v3 7.5

EPSS 0.7997

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-287

Status published

Products (2)

athlon1600/php-proxy-app 0Packagist

php-proxy/php-proxy 3.0.3

Published Nov 22, 2018

Tracked Since Feb 18, 2026