What is CVE-2018-19196?

CVE-2018-19196 is a critical-severity vulnerability in Xiaocms, classified under Code Injection. CVSS score: 9.8/10. Published 2018-11-12.

How severe is CVE-2018-19196?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Xiaocms

CVE-2018-19196

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.033 (87.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Xiaocms — versions 20141229
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC, Broken Link)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-19196?: CVE-2018-19196 is a critical-severity vulnerability in Xiaocms, classified under Code Injection. CVSS score: 9.8/10. Published 2018-11-12.
How severe is CVE-2018-19196?: Critical severity. CVSS v3 base score is 9.8 out of 10.