What’s Vulnerable › Vulnerabilities

CVE-2018-17826

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-10-01 · updated 2026-06-17
• Weakness: CWE-352

Description

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types (.jpg, .png, .gif, .jpeg, and .ico).

Affected products

• hisiphp: 1.0.8

References

• https://github.com/rakjong/vuln/blob/master/hisiphp_getshell.pdf
• https://github.com/rakjong/vuln/blob/master/hisiphp_getshell.pdf

Get alerted when CVE-2018-17826 or the next vulnerability affects your stack