cbcvebase.
CVE-2018-20323
published 2019-03-21

CVE-2018-20323: www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.

PriorityP277high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
55.12%
98.9th percentile
www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.

Affected

1 ranges
VendorProductVersion rangeFixed in
mailcleanermailcleaner——

Detection & IOCsextracted from sources · hover to see the quote

pathwww/soap/application/MCSoap/Logs.php↗
  • →Monitor HTTP requests to /admin/managetracing/search/search for anomalous or shell-metacharacter-containing parameter values indicative of command injection attempts. ↗
  • →Monitor HTTP requests to www/soap/application/MCSoap/Logs.php for OS command injection payloads in parameters. ↗
  • →The exploit runs under the context of the web server user which is root — any web-originated process spawning a shell on MailCleaner should be treated as high-severity. ↗
  • ·Exploitation requires prior authentication to the MailCleaner admin interface. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.