VULNERABILITY INTELLIGENCE
CVE-2018-19274
CVSS score7.2 HIGH
EPSS probability5.20%
CISA KEVNot currently listed
Published2018-11-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
Weakness classification
- CWE-502: Deserialization of Untrusted Data
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Primary references
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory