CVE-2018-7251 — AI Deep Analysis Summary

🚨 **Essence**: Anchor CMS 0.12.3 has an **Information Disclosure** flaw in `config/error.php`.…

🛡️ **Root Cause**: Improper handling of error logs. The file `config/error.php` exposes the error log at a public URI.…

📦 **Affected**: **Anchor CMS** versions up to **0.12.3**. <br>⚙️ **Component**: Specifically the `config/error.php` file and the generated `errors.log`.

🕵️ **Attacker Action**: Retrieve sensitive **MySQL credentials** from the error log. <br>🔓 **Impact**: Potential full database compromise if credentials are reused or weak. No authentication required to view the log.

📉 **Threshold**: **LOW**. <br>🚫 **Auth**: No authentication needed. <br>🌐 **Access**: Simply visit the `errors.log` URI. Exploitation is trivial if an error has occurred previously.

📜 **Public Exp?**: **YES**. <br>🔗 **PoC**: Available via Nuclei templates and PacketStorm. <br>🌍 **Wild Exp**: Easy to automate scanning for exposed `errors.log` files.

🔍 **Self-Check**: Scan for the existence of `/errors.log` or similar error log URIs. <br>📡 **Tooling**: Use Nuclei templates or simple HTTP requests to check for 200 OK responses on error log paths.

✅ **Fixed?**: **YES**. <br>🔧 **Patch**: Upgrade to **Anchor CMS 0.12.7** or later. <br>📝 **Ref**: GitHub release notes confirm the fix.

🛑 **No Patch?**: <br>1. **Block Access**: Use `.htaccess` or Nginx config to deny access to `errors.log`. <br>2. **Disable Logging**: Temporarily disable error logging in production if safe. <br>3.…

🔥 **Urgency**: **HIGH**. <br>⚠️ **Reason**: Credential leakage is critical. Easy to exploit without auth. <br>🚀 **Action**: Patch immediately or apply strict access controls to log files.