CVE-2018-1000207

published 2018-07-13

CVE-2018-1000207: MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can…

Priority P2 78 high 7.2 CVSS 3.0

AV N AC L PR H UI N S U C H I H A H

ITW VulnCheck KEV

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
modx	modx_revolution	<= 2.6.4	—
modx	revolution	>= 0 < 2.7.0	2.7.0

Detection & IOCs extracted from sources · hover to see the quote

url https://www.exploit-db.com/exploits/45055↗

snort↗

alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Modx Revolution RCE (CVE-2018-1000207)"; flow:established,to_server; http.uri; content:".php"; http.request_body; content:"useRawIMoutput"; content:"IMresizedData"; content:"config_prefer_imagemagick"; fast_pattern; reference:cve,2018-1000207; reference:url,www.exploit-db.com/exploits/45055; classtype:attempted-admin; sid:2025930; rev:3; metadata:attack_target Web_Server, created_at 2018_08_01, cve CVE_2018_100020, deployment Datacenter, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_04;)

• → Detect HTTP POST requests to any .php endpoint containing the phpthumb-specific body parameters 'useRawIMoutput', 'IMresizedData', and 'config_prefer_imagemagick' — all three together indicate exploitation of the MODX Revolution phpthumb RCE. ↗
• → The vulnerability involves insufficient filtering of user parameters passed into the phpthumb class, allowing creation of a file with a custom filename and content via a web request — monitor for unexpected file creation (especially .php files) in web-accessible directories on MODX Revolution <=2.6.4 instances. ↗

• · The fix is tied to a specific commit; verify the patch is applied. Instances running MODX Revolution <=2.6.4 without commit 06bc94257408f6a575de20ddb955aca505ef6e68 remain vulnerable. ↗

CVSS provenance

nvd v3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-732