CVE-2018-14579
Last modified
CVE-2018-14579 is a vulnerability of currently unknown severity. GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.. EPSS estimates a 1.60% chance of exploitation in the next 30 days.
Description
GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Golemcms Project | Golemcms | <= 2008-12-24 |
References
- https://github.com/havysec/Useful_Code/blob/master/mycve/001.mdExploit, Third Party Advisory
- https://github.com/havysec/Useful_Code/blob/master/mycve/001.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-14579?
How severe is CVE-2018-14579?
How do I fix CVE-2018-14579?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14570A file upload vulnerability in application/shop/controller/m…
- CVE-2018-14572In conference-scheduler-cli, a pickle.load call on imported …
- CVE-2018-14573A Local File Inclusion (LFI) vulnerability exists in the Web…
- CVE-2018-14574django.middleware.common.CommonMiddleware in Django 1.11.x b…
- CVE-2018-14575Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XS…
- CVE-2018-14576The mintTokens function of a smart contract implementation f…7.5
- CVE-2018-1458IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Se…7.4
- CVE-2018-14581Redgate .NET Reflector before 10.0.7.774 and SmartAssembly b…
- CVE-2018-14582index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSR…
- CVE-2018-14583xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a…
- CVE-2018-14584An issue has been discovered in Bento4 1.5.1-624. AP4_AvccAt…
- CVE-2018-14585An issue has been discovered in Bento4 1.5.1-624. AP4_BytesT…
Are you affected by CVE-2018-14579?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST