CVE-2018-19550

published 2018-11-26

CVE-2018-19550: Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a…

Priority P2 62 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
interspire	email_marketer	<= 6.5.0	—
interspire	email_marketer	<= 6.1.6	—
interspire	email_marketer	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /iem/surveys_submit.php?formId=1337↗

path /admin/temp/surveys/↗

url http://{{IEM LINK}}/admin/temp/surveys/1337/{{FUZZING NUMBER}}/{{FILENAME}}↗

filename info.php↗

command widget[0][field][][value]↗

• → Detect multipart POST requests to surveys_submit.php with a file upload field named 'widget[0][field][][value]' containing a .php filename — this is the exploit delivery mechanism for arbitrary PHP file upload. ↗
• → Monitor HTTP GET requests to /admin/temp/surveys/ for .php file access, which would indicate successful webshell/payload deployment following exploitation. ↗
• → Alert on file creation of .php files under the surveys temp directory path (TEMP_DIRECTORY/surveys/<formId>/<responseId>/), as the application moves uploaded files there without extension validation. ↗

• · CVE-2018-19550 was incompletely patched; CVE-2022-40777 covers the bypass, meaning versions up to 6.5.0 remain vulnerable even after the original fix was applied. Detection rules should cover both CVEs on the same endpoint. ↗
• · The formId parameter in the exploit URL is attacker-controlled (e.g., 1337), meaning the upload path directory name is arbitrary — detection based on a fixed path suffix alone may miss variants with different formId values. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434