CVE-2018-19126

published 2018-11-09

CVE-2018-19126: PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.

Priority P2 76 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
prestashop	prestashop	>= 1.6.0.1 < 1.6.1.23	1.6.1.23
prestashop	prestashop	>= 1.7.0.0 < 1.7.4.4	1.7.4.4

Detection & IOCs extracted from sources · hover to see the quote

path /filemanager/dialog.php↗

path /filemanager/upload.php↗

path /filemanager/execute.php?action=rename_folder↗

path /filemanager/ajax_calls.php?action=image_size↗

filename phar.pdf↗

command phar://../../img/renamed/phar.pdf/img/cms/↗

• → Alert on any POST body containing a 'path' parameter value starting with 'phar://' submitted to filemanager endpoints, which is the phar deserialization trigger. ↗
• → Flag upload of files with a .pdf extension that contain a valid Phar archive magic header/stub, indicating a disguised phar payload uploaded to bypass extension checks. ↗
• → Detect POST to execute.php?action=rename_folder renaming the 'images' directory to 'renamed', which is used to bypass the realpath() check in the exploit chain. ↗
• → The exploit uses Monolog gadget chain (SyslogUdpHandler / BufferHandler) for PHP object deserialization RCE; detect Monolog-based gadget chain artifacts in phar metadata on disk under the PrestaShop img directory. ↗
• → The exploit authenticates to the PrestaShop admin login endpoint via AJAX before accessing filemanager; correlate admin login AJAX calls immediately followed by filemanager access from the same source IP as a suspicious sequence. ↗

• · The exploit targets PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4; detection should be scoped to these version ranges to reduce false positives on patched installations. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434