CVE-2018-1999022 Code injection in n/a

Critical 9.8 Published 23 Jul 2018 Updated 16 Sep 2024

Attackers can execute arbitrary code, read data, or modify data via crafted query strings in the PEAR HTML_QuickForm library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1999022?

CVE-2018-1999022 is a critical code injection vulnerability in n/a, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

Weakness: CWE-94

Which versions are affected by CVE-2018-1999022?

It affects 2 products.

Products include Civicrm Civicrm, Html Quickform Project Html Quickform.

How do I fix CVE-2018-1999022?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-1999022 being exploited?

There is no known exploitation of CVE-2018-1999022 in the wild and no public exploit code.

Sources

Also known as CVE-2018-1000212, DEBIAN-CVE-2018-1999022, GHSA-ppg7-5cr7-7v24, MGASA-2019-0049, UBUNTU-CVE-2018-1999022.