CVE-2019-12185: eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An…

PriorityP271high8.8CVSS 3.0

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

18.11%

96.8th percentile

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
elabftw	elabftw	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/app/controllers/EntityController.php↗

path/uploads/↗

urlhttps://[vulnerable site]/elabftw/uploads/60/6054a32461de6294843b7f7ea9ea2a34a19ca420752b087c87011144fc83f90b9aa5bdcdce5dee132584f6da45b7ec9e3841405e9d67a7d196f064116cf2da38.php5?e=whoami↗

cookiePHPSESSID=<session>; token=<formkey>↗

→Detect POST requests to /app/controllers/EntityController.php with multipart/form-data content-type containing a file field with a .php5 extension, indicating attempted webshell upload. ↗
→Alert on files with .php5 extension being written under the /uploads/ directory of the eLabFTW web root, as the exploit drops the webshell there. ↗
→Monitor for HTTP GET requests to /uploads/**/*.php5?e= which is the webshell execution pattern used by this exploit. ↗
→The exploit uses the multipart boundary '---------------------------72167598110874594111630395077'; detecting this static boundary in POST bodies to EntityController.php is a high-fidelity indicator of this specific PoC. ↗

·The exploit requires a valid authenticated user account to perform the upload; the vulnerability is not unauthenticated. Detection should account for authenticated sessions abusing the upload endpoint. ↗
·The dropped webshell filename is a random long alphanumeric string under a random 2-character alphanumeric subdirectory; static filename-based detection will not work — pattern-based detection on .php5 files in /uploads/ is required. ↗
·The PoC was tested on a default Softaculous installation on Linux with PHP 7.0.33; behavior may differ on non-default configurations or other PHP versions. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.