cve/2018/CVE-2018-19422.md

CVE-2018-19422

Description

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

POC

Reference

• http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html
• http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html

Github

• https://github.com/RajatSethi2001/FUSE
• https://github.com/Swammers8/SubrionCMS-4.2.1-File-upload-RCE-auth-
• https://github.com/WSP-LAB/FUSE
• https://github.com/h3v0x/CVE-2018-19422-SubrionCMS-RCE
• https://github.com/hev0x/CVE-2018-19422-SubrionCMS-RCE
• https://github.com/superlink996/chunqiuyunjingbachang