CVE-2018-20526
published 2019-03-21CVE-2018-20526: Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
PriorityP188critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
73.66%
99.4th percentile
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roxyfileman | roxy_fileman | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for the presence of the WebKitFormBoundary string '----WebKitFormBoundary20kgW2hEKYaeF5iP' in multipart upload requests to upload.php, which is used in known exploit templates. ↗
- →Detect POST requests to copydir.php or copyfile.php containing dot-dot-slash (../) path traversal sequences in the 'd' or 'f' parameters. ↗
- →Use Shodan or FOFA to identify exposed Roxy File Manager instances via their page title for proactive asset discovery. ↗
- →After successful upload, the attacker accesses the uploaded file via GET request to /Uploads/<filename>; monitor for GET requests to /Uploads/*.php7 or /Uploads/*.php.png returning HTTP 200. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jf88-mw32-x424: Roxy Fileman 1
ghsa_unreviewed·2022-05-14
CVE-2018-20526 [CRITICAL] CWE-434 GHSA-jf88-mw32-x424: Roxy Fileman 1
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
VulnCheck
roxyfileman roxy_fileman Unrestricted Upload of File with Dangerous Type
vulncheck·2018·CVSS 9.8
CVE-2018-20526 [CRITICAL] roxyfileman roxy_fileman Unrestricted Upload of File with Dangerous Type
roxyfileman roxy_fileman Unrestricted Upload of File with Dangerous Type
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
Affected: roxyfileman roxy_fileman
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points
No detection rules found.
Exploit-DB
Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal
exploitdb·2019-01-07·CVSS 9.1
CVE-2018-20526 [CRITICAL] Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal
Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal
---
Exploit Title:: Multiple Vulnerabilities
Software: Roxy Fileman
Version: 1.4.5
Vendor Homepage: http://www.roxyfileman.com/
Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php
CVE number: CVE-2018-20525, CVE-2018-20526
Found: 2018-12-07
Tested on: PHP 7.0, Ubuntu 16.04 LTS
Author: Pongtorn Angsuchotmetee, Vittawat Masaree
SnoopBees Lab
https://www.snoopbees.com
Description
Roxy Fileman is free open source file browser for .NET and PHP, ready for
use with CKEditor and TinyMCE WYSIWYG html editors. It could be easily
integrated into a CMS or any other web application. Fileman is based on
JQuery and JQueryUI libraries and it's compatible with all modern browsers
- Internet Explorer, Firefox, Google Chrome
Nuclei
Roxy Fileman 1.4.5 - Unrestricted File Upload
nuclei·CVSS 9.8
CVE-2018-20526 [CRITICAL] Roxy Fileman 1.4.5 - Unrestricted File Upload
Roxy Fileman 1.4.5 - Unrestricted File Upload
Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
Template:
id: CVE-2018-20526
info:
name: Roxy Fileman 1.4.5 - Unrestricted File Upload
author: DhiyaneshDK
severity: critical
description: |
Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability can result in remote code execution, allowing an attacker to ex
2019-03-21
Published
Exploited in the wild