Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-16974

CVE-2018-16974:
Elefant CMS Code Execution Vulnerability

9.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-16974
GHSA ID
GHSA-77j2-7whr-6vpx
EPSS Score
0.50087%
CWE
CWE-434
Published
5/14/2022
Updated
7/25/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
elefant/cmscomposer< 2.0.72.0.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. post_rm in API.php allowed critical .htaccess deletion due to insufficient input validation (no trimming/whitelisting).
  2. upload/drop.php's filename validation used urldecode() without trim(), letting attackers bypass .php blacklist with trailing spaces.
  3. FileManager::verify_file_name's regex didn't account for space-based extension hiding or protect .htaccess files. The commit diff shows these were all addressed by adding trim() calls and expanding blacklist patterns.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in *l***nt *MS ***or* *.*.*. T**r* is * P*P *o** *x**ution Vuln*r**ility in `*pps/*il*m*n***r/uplo**/*rop.p*p` *y usin* `/*il*m*n***r/*pi/rm/.*t****ss` to r*mov* t** .*t****ss *il*, *n* t**n usin* * *il*n*m* t**t *n*s in .p*p

Reasoning

*. post_rm in *PI.p*p *llow** *riti**l .*t****ss **l*tion *u* to insu**i*i*nt input v*li**tion (no trimmin*/w*it*listin*). *. uplo**/*rop.p*p's *il*n*m* v*li**tion us** url***o**() wit*out trim(), l*ttin* *tt**k*rs *yp*ss .p*p *l**klist wit* tr*ilin*