Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1wYzVoLW05NWctdjZyaM4AAUko

LFI in PHP-Proxy 5.1.0

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.

Permalink: https://github.com/advisories/GHSA-pc5h-m95g-v6rh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wYzVoLW05NWctdjZyaM4AAUko
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: 10 months ago


CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-pc5h-m95g-v6rh, CVE-2018-19246
References: Repository: https://github.com/Athlon1600/php-proxy-app
Blast Radius: 11.3

Affected Packages

packagist:athlon1600/php-proxy
Dependent packages: 5
Dependent repositories: 32
Downloads: 93,791 total
Affected Version Ranges: <= 5.1.0
No known fixed version
All affected versions: 1.0.0, 3.0.0, 4.0.2, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5