CVE-2018-17442

published 2018-10-08

CVE-2018-17442: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint…

Priority P2 69 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	central_wifimanager	>= 1.00 < 1.03	1.03

Detection & IOCs extracted from sources · hover to see the quote

url https://127.0.0.1/index.php/Config/onUploadLogPic↗

url https://127.0.0.1/captivalportal/↗

path /web/captivalportal↗

path /web/public↗

url https://127.0.0.1/index.php/ReportSecurity/ExportAP/type/TXT↗

port 9000↗

command ftp.storbinary("STOR write_file.php", php_file)↗

url /index.php/Config/UpdateSite↗

url /index.php/System/addUser↗

• → Monitor for POST requests to the /index.php/Config/onUploadLogPic endpoint, especially those uploading .tar or .rar archive files containing PHP scripts — this is the direct exploitation vector for CVE-2018-17442. ↗
• → Alert on HTTP GET requests to /captivalportal/<epoch_timestamp>/poc.php or any .php file under /captivalportal/ — this indicates post-upload PHP webshell execution. ↗
• → Detect FTP connections to port 9000 with credentials admin/admin, followed by a STOR command placing .php files into /web/public — this is the unauthenticated RCE vector (CVE-2018-17440, related). ↗
• → Flag GET requests to /index.php/ReportSecurity/ExportAP/type/TXT immediately before a POST to /index.php/Config/onUploadLogPic — this two-step sequence is used by the exploit to obtain server time before uploading the malicious archive. ↗
• → Detect PHP files written into /web/public or /web/captivalportal directories on the D-Link Central WiFiManager host — legitimate application operation should not place .php files in these paths. ↗

• · The FTP server runs on port 9000 by default with hardcoded credentials (admin/admin) and the application does not expose an option to change them, making credential-based detection unreliable for distinguishing legitimate from malicious FTP use. ↗
• · The upload destination folder name is derived from PHP time() (Unix epoch), so the exact path under /web/captivalportal is dynamic and will vary per exploitation attempt; detection must use a wildcard/regex pattern rather than a static path. ↗
• · The exploit iterates up to 20 epoch values after upload to locate the correct folder, meaning up to 20 sequential GET requests to /captivalportal/<epoch>/poc.php may be observed before successful execution. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434