CVE-2018-17827 HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php.
HighCVSS 7.2
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hisiphp | = 1.0.8 | No fix listed |
References
- github.com exploit technical-description third-party-advisory