CVE-2018-16716

published 2019-05-02

CVE-2018-16716: A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary…

Priority P2 64 critical 9.1 CVSS 3.0

AV N AC L PR N UI N S U C H I H A N

EXPLOIT

A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nih	ncbi_toolbox	2.0.7 – 2.2.26	—

Detection & IOCs extracted from sources · hover to see the quote

path /blast/nph-viewgif.cgi?../../../../etc/passwd↗

filename nph-viewgif.cgi↗

filename viewcgi.c↗

• → Send a GET request to /blast/nph-viewgif.cgi with a path traversal query string (e.g., ../../../../etc/passwd) and look for a 200 HTTP response containing the pattern root:[x*]:0:0 in the body, indicating successful arbitrary file read.
• → The vulnerability is triggered via the query string of nph-viewgif.cgi; monitor HTTP access logs for requests to this CGI endpoint containing directory traversal sequences (../).

• · Affected versions are NCBI ToolBox 2.0.7 through 2.2.26 (legacy); detections should be scoped to these version ranges to avoid false positives on patched or unrelated deployments. ↗

CVSS provenance

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22