CVE-2019-12099

published 2019-05-14

CVE-2019-12099: In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and…

Priority P2 70 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
php-fusion	php-fusion	< 9.03.00	9.03.00

Detection & IOCs extracted from sources · hover to see the quote

path images/avatars/↗

path edit_profile.php↗

path includes/dynamics/includes/form_fileinput.php↗

path includes/classes/PHPFusion/Installer/Lib/Core.settings.inc↗

• → Monitor for PHP webshell uploads to the avatars directory (images/avatars/). Any .php or executable file appearing under this path is a strong indicator of exploitation. ↗
• → Detect multipart/form-data POST requests to edit_profile.php containing a file upload with a PHP extension — the exploit bypasses client-side JS extension checks by intercepting the request. ↗
• → Look for the 'delAvatar' parameter set to '1' in a POST to edit_profile.php immediately followed by a file upload POST to the same endpoint — this two-stage pattern (delete then upload) is characteristic of the exploit workflow. ↗
• → The exploit uses a bare 'Mozilla' User-Agent string (not a full browser UA) for its upload requests — flag POST requests to edit_profile.php with this anomalous agent. ↗
• → The exploit extracts fusion_token from the response body and replays it; monitor for rapid sequential GET then POST to home.php and edit_profile.php from the same source IP as a login-then-upload chain. ↗
• → No admin privilege is required — exploitation is possible with any authenticated (ordinary) user account. Audit all user-level accounts for unexpected avatar file types in images/avatars/. ↗

• · The client-side file-type check is JavaScript-only and trivially bypassed via an interception proxy; server-side controls in form_fileinput.php and Core.settings.inc are the root cause and must be patched. ↗
• · The fix is tracked in upstream commit 943432028b9e674433bb3f2a128b2477134110e6 on GitHub; deployments should verify this commit is present. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434