CVE-2018-12909

published 2018-06-27

CVE-2018-12909: Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an…

Priority P3 57 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
webgrind_project	webgrind	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /index.php?op=fileviewer&file=/etc/passwd↗

path /index.php?op=fileviewer&file=↗

• → Look for HTTP GET requests to index.php with query parameters op=fileviewer and a file= parameter pointing to local filesystem paths (e.g., /etc/passwd). No authentication is required. ↗
• → A successful exploitation response (HTTP 200) will contain both the string 'webgrind' and a passwd-file pattern matching 'root:.*:0:0:' in the response body. ↗
• → Use FOFA queries 'app="Webgrind"' or 'app="webgrind"' to identify exposed Webgrind instances on the internet. ↗

• · The file read is limited to files accessible by the web server OS user account; privilege escalation beyond that user's permissions is not directly possible via this vector alone. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:C/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22