CVE-2018-1000042

Name: CVE-2018-1000042
Creator: NVD / NIST
Published: 2018-02-09T23:29:01.323+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.92%

Last modified Jun 17, 2026

CVE-2018-1000042 is a vulnerability of currently unknown severity. Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web request to .inc/callback.php with the payload in the data or obj parameters, used in autocat(). EPSS estimates a 3.92% chance of exploitation in the next 30 days.

Description

Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web request to .inc/callback.php with the payload in the data or obj parameters, used in autocat(). This vulnerability appears to have been fixed in 1.7.0.

Metrics

EPSS Probability

3.92%

89.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Securityonion	Squert	>= 1.1.1, <= 1.6.7

References

http://blog.securityonion.net/2018/01/security-advisory-for-squert.htmlPatch, Vendor Advisory
http://blog.securityonion.net/2018/01/security-advisory-for-squert.htmlPatch, Vendor Advisory

Timeline

Published: Feb 9, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-1000042?

How severe is CVE-2018-1000042?

Severity scoring for CVE-2018-1000042 is pending analysis. The EPSS model estimates a 3.92% probability of exploitation in the next 30 days.

How do I fix CVE-2018-1000042?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1000042?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST