CVE-2018-1000885
Last modified
CVE-2018-1000885 is a vulnerability of currently unknown severity. PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in function pgp_exec() phkp.php:98 that can result in It is possible to manipulate gpg-keys or execute commands remotely. This attack appear to be exploitable via HKP-Api: /pks/lookup?search.. EPSS estimates a 3.22% chance of exploitation in the next 30 days.
Description
PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in function pgp_exec() phkp.php:98 that can result in It is possible to manipulate gpg-keys or execute commands remotely. This attack appear to be exploitable via HKP-Api: /pks/lookup?search.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phkp Project | Phkp | All versions |
References
- https://tech.feedyourhead.at/content/full-disclosure-remote-command-execution-in-phkpExploit, Third Party Advisory
- https://tech.feedyourhead.at/content/full-disclosure-remote-command-execution-in-phkpExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1000885?
How severe is CVE-2018-1000885?
How do I fix CVE-2018-1000885?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1000879libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5…6.5
- CVE-2018-1000880libarchive version commit 9693801580c0cf7c70e862d305270a16b5…6.5
- CVE-2018-1000881Traccar Traccar Server version 4.0 and earlier contains a CW…
- CVE-2018-1000882WeBid version up to current version 1.2.2 contains a Directo…
- CVE-2018-1000883Elixir Plug Plug version All contains a Header Injection vul…
- CVE-2018-1000884Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6a…
- CVE-2018-1000886nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vul…
- CVE-2018-1000887Peel shopping peel-shopping_9_1_0 version contains a Cross S…
- CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-50…
- CVE-2018-1000889Logisim Evolution version 2.14.3 and earlier contains an XML…
- CVE-2018-1000890FrontAccounting 2.4.5 contains a Time Based Blind SQL Inject…
- CVE-2018-1000891Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
Are you affected by CVE-2018-1000885?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST