Which products and versions are affected by CVE-2018-19246?

Affected: PHP-Proxy versions 5.1.0; athlon1600/php-proxy (composer). The full list is in the CVE brief.

Is CVE-2018-19246 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2018-19246 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2018-19246?

Public exploit code is available.

Is there a fix for CVE-2018-19246?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2018-19246 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2018-19246PHP-Proxy Information Disclosure

LFI in PHP-Proxy 5.1.0

Published May 14, 2022 · Updated Aug 5, 2024 · Also known as GHSA-pc5h-m95g-v6rh

Key Facts

Patch immediately

CVE-2018-19246 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting PHP-Proxy, athlon1600/php-proxy (composer).
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 22% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

22%

Higher than 97.6% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

46/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2018-19246
advisoryGHSA advisory
advisoryhttps://github.com/Athlon1600/php-proxy/pull/126

Description

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
PHP-ProxyPHP-Proxy	5.1.0	n/a
athlon1600/php-proxycomposer	See advisory	n/a

Timeline

Publicly disclosed
May 14, 2022
Last updated
Aug 5, 2024

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

1 more references in the full CVE brief

FAQ

Common Questions.

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used.
Affected: PHP-Proxy versions 5.1.0; athlon1600/php-proxy (composer). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2018-19246 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.