GitHub Advisoryadvisory · Packagist

GHSA-3x3m-p2wx-g7cw Unauthenticated File Read in PHP Proxy

HIGH Published 2022-05-14 Modified 2023-07-07 Official page ↗
Aliases
CVE-2018-19458
Ecosystem
Packagist
Packages
athlon1600/php-proxy-app
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-287
Reviewed
2023-07-07

Affected packages

• Packagist athlon1600/php-proxy-app: <= 3.0 (no fix yet)

Description

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an `index.php?q=file:///` LFI URI, a different vulnerability than CVE-2018-19246.

Related

Alias · CVE (1)

  • CVE-2018-19458 In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References