VULNERABILITY INTELLIGENCE

CVE-2018-19196

CVSS score9.8 CRITICAL

EPSS probability3.30%

CISA KEVNot currently listed

Published2018-11-12

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.

Weakness classification

CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Broken Link, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory