CVE-2018-19422

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Score

CVSS 3.1 7.2 High

Status

Modified - cve@mitre.org

Published

2018-11-21

Last modified

2024-08-05

Weaknesses

CWE-434

Affected products

• Subrion Cms (Intelliants)

References

• http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html
• http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html
• https://github.com/intelliants/subrion/issues/801