Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wYzVoLW05NWctdjZyaM4AAUko
LFI in PHP-Proxy 5.1.0
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187
app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wYzVoLW05NWctdjZyaM4AAUko
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: 10 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-pc5h-m95g-v6rh, CVE-2018-19246
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-19246
- https://github.com/Athlon1600/php-proxy-app/issues/134
- https://www.exploit-db.com/exploits/45861/
- https://github.com/Athlon1600/php-proxy/pull/126
- https://github.com/advisories/GHSA-pc5h-m95g-v6rh
Blast Radius: 11.3
Affected Packages
packagist:athlon1600/php-proxy
Dependent packages: 5Dependent repositories: 32
Downloads: 93,791 total
Affected Version Ranges: <= 5.1.0
No known fixed version
All affected versions: 1.0.0, 3.0.0, 4.0.2, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5