7.5high
CVE-2018-25178
Easyndexer 1.0 Arbitrary File Download via showtif.php
Published 8 mo ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 52%
Public exploits
0
none known
Summary
Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction (EPSS)
0.66% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Sourceforge Easyndexer
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- exploit-db.com /exploits/45835 · exploit
- vulncheck.com /advisories/easyndexer-arbitrary-file-download-via-showtifphp · third-party-advisory
Sources
- CVE List: CVE-2018-25178
- NVD: CVE-2018-25178
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.