CVE-2020-19625

published 2021-03-26

CVE-2020-19625: Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gridx_project	gridx	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /tests/support/stores/test_grid_filter.php↗

url {{BaseURL}}/tests/support/stores/test_grid_filter.php?query=echo%20md5%28%22CVE-2020-19625%22%29%3B

• → Detect exploitation attempts by monitoring GET requests to the path /tests/support/stores/test_grid_filter.php with a non-empty `query` parameter, especially containing PHP execution payloads (e.g., echo, md5, system calls).
• → A successful RCE probe response will contain the MD5 hash string '6ca86c2c17047c14437f55c42c801c10' (md5 of 'CVE-2020-19625') in the HTTP response body with a 200 status code, indicating code execution occurred.

• · The vulnerable endpoint is located within the /tests/ directory, which is a test/support path that should not be exposed in production deployments. Exploitation is only possible if this path is publicly accessible. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.