GHSA-73xj-v6gc-g5p5

Subrion CMS RCE Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-19422

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	intelliants/subrion	< 4.2.2	4.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

`/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-19422 advisory
https://github.com/intelliants/subrion/issues/801 web
https://github.com/intelliants/subrion/commit/74359bcfaea424edda6d782a8ac25397c55972ab web
http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html web
http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html web