cvelist/2018/1999xxx/CVE-2018-1999022.json

{     "CVE_data_meta": {         "ASSIGNER": "kurt@seifried.org",         "DATE_ASSIGNED": "2018-07-22T01:05:34.777936",         "DATE_REQUESTED": "2018-07-19T23:25:02",         "ID": "CVE-2018-1999022",         "REQUESTER": "pear-group@php.net"     },     "affects": {         "vendor": {             "vendor_data": [                 {                     "product": {                         "product_data": [                             {                                 "product_name": "HTML_QuickForm",                                 "version": {                                     "version_data": [                                         {                                             "version_value": "3.2.14"                                         }                                     ]                                 }                             }                         ]                     },                     "vendor_name": "PEAR"                 }             ]         }     },     "data_format": "MITRE",     "data_type": "CVE",     "data_version": "4.0",     "description": {         "description_data": [             {                 "lang": "eng",                 "value": "PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's  validate method,   HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15."             }         ]     },     "problemtype": {         "problemtype_data": [             {                 "description": [                     {                         "lang": "eng",                         "value": "eval injection (CWE-95)"                     }                 ]             }         ]     },     "references": {         "reference_data": [             {                 "url": "http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/"             },             {                 "url": "https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform"             }         ]     } }