CVE-2018-16604 Code injection in n/a
An authenticated attacker can execute arbitrary PHP code by injecting payloads into the username field due to improper handling of double quotes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16604?
CVE-2018-16604 is a high-severity code injection vulnerability in n/a, published on 6 Sep 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}").
Weakness: CWE-94
Which versions are affected by CVE-2018-16604?
It affects 1 product.
Products include Nibbleblog Nibbleblog.
How do I fix CVE-2018-16604?
No fix has been published for CVE-2018-16604 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-16604 being exploited?
There is no known exploitation of CVE-2018-16604 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q7mm-h7vg-6554.