CVE-2018-19422 — AI Deep Analysis Summary

🚨 **Essence**: Subrion CMS 4.2.1 has a critical file upload flaw. The `/panel/uploads` directory lacks proper restrictions in `.htaccess`.…

🛡️ **Root Cause**: Misconfiguration of the `.htaccess` file. ❌ **Flaw**: It fails to block execution of `.pht` and `.phar` extensions.…

🏢 **Vendor**: Subrion Team (Intelliants). 📦 **Product**: Subrion CMS. 📅 **Affected Version**: Specifically **4.2.1**. ⚠️ **Component**: The `/panel/uploads` directory is the attack vector.

🔓 **Privileges**: Remote attackers gain the ability to execute code with the web server's privileges. 💾 **Data**: Can access, modify, or delete any data on the server.…

🔑 **Auth Required**: YES. The exploit requires valid credentials (`-l <user> -p <password>`). 📊 **Threshold**: Medium.…

💻 **Public Exploit**: YES. Multiple PoCs exist on GitHub (e.g., `CVE-2018-19422-SubrionCMS-RCE`). 🌐 **Availability**: Scripts are available for Windows/Linux.…

🔍 **Check**: Scan for Subrion CMS version 4.2.1. 📂 **Verify**: Check if `/panel/uploads` exists and if `.htaccess` allows `.pht`/`.phar` execution.…

🩹 **Fix**: The vendor acknowledged the issue (GitHub Issue #801). 📝 **Mitigation**: Update `.htaccess` to explicitly deny execution of `.pht` and `.phar` files.…

🚧 **Workaround**: Manually edit the `.htaccess` file in `/panel/uploads`. ➕ **Rule**: Add `RemoveHandler .pht .phar` or `SetHandler` directives to block these extensions.…

⚡ **Priority**: HIGH. 🚨 **Urgency**: RCE vulnerabilities are critical. Even with auth, the ease of exploitation via public scripts makes this a top-priority fix.…