CVE-2018-20166

published 2019-01-02

CVE-2018-20166: A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles…

Priority P2 62 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
rukovoditel	rukovoditel	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /index.php?module=configuration/save&redirect_to=configuration/login_page↗

url /index.php?module=users/login&action=login↗

url /index.php?module=configuration/login_page↗

url /uploads/↗

cookie cookie_test=please_accept_for_session; sid=<md5>↗

filename .pHp↗

• → Detect PHP webshell upload attempts to Rukovoditel's configuration/save endpoint where the uploaded filename ends in a mixed-case .php extension (e.g., .pHp, .Php, .PhP) and the file content begins with GIF magic bytes. ↗
• → Monitor POST requests to /index.php?module=configuration/save containing multipart/form-data with a filename matching the regex \.[pP][hH][pP] as an indicator of exploitation. ↗
• → Alert on GET requests to /uploads/ following a POST to /index.php?module=configuration/save, which indicates the attacker is executing the uploaded webshell. ↗
• → Detect the session cookie pattern 'cookie_test=please_accept_for_session' in HTTP requests, which is a static string used by the Metasploit exploit module for this CVE. ↗

• · The exploit requires authenticated access; detection should account for a prior successful login POST to /index.php?module=users/login&action=login before the malicious upload occurs. ↗
• · The .htaccess file blocks many file extensions, so the bypass specifically relies on mixed-case PHP extensions that evade the case-sensitive extension blacklist. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434