/CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422 Authenticated Remote Code Execution

Primary LanguagePython

CVE-2018-19422-SubrionCMS-RCE

SubrionCMS 4.2.1 Authenticated Remote Code Execution

  • /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Exploit Usage

Commands:

  • Windows/Linux: $ sudo python3 subrionRCE.py -u http://IP/panel/ -l <user> -p <password>