Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-19422

CVE-2018-19422: Subrion CMS RCE Vulnerability

7.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-19422
GHSA ID
GHSA-73xj-v6gc-g5p5
EPSS Score
0.99103%
CWE
CWE-434
Published
5/13/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
intelliants/subrioncomposer<= 4.2.14.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two factors: 1) The upload handler function in the admin panel (likely in admin/panel/uploads.php) failed to validate() against .pht/.phar extensions, allowing their upload. 2) The .htaccess file in the uploads directory didn't restrict these extensions, enabling execution. While the commit diff shows the .htaccess fix, the root vulnerability requires an upload handler that permits dangerous file types. The combination of permissive upload handling and insecure server configuration creates the RCE vulnerability. The high confidence comes from the CWE-434 classification and the explicit attack vector described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

`/p*n*l/uplo**s` in Su*rion *MS *.*.* *llows r*mot* *tt**k*rs to *x**ut* *r*itr*ry P*P *o** vi* * .p*t or .p**r *il*, ****us* t** .*t****ss *il* omits t**s*.

Reasoning

T** vuln*r**ility st*ms *rom two ***tors: *) T** uplo** **n*l*r `*un*tion` in t** **min p*n*l (lik*ly in `**min/p*n*l/uplo**s.p*p`) **il** to `v*li**t*()` ***inst .p*t/.p**r *xt*nsions, *llowin* t**ir uplo**. *) T** `.*t****ss` *il* in t** uplo**s *i