CVE-2018-19514 - In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication

Back Back to CVE browser

CRITICAL

In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication

Published Mar 17, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 4.93%

Description

In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file with a malicious payload that becomes part of a PHP eval() expression in the subscriber.php file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jan/15
x_refsource_MISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jan/15		x_refsource_MISCExploitMailing ListThird Party Advisory