CVE-2018-5749

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-01-23 · updated 2026-06-17
Weakness: CWE-434

Description

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

Affected products

Minecraft Servers List Lite Project Minecraft Servers List Lite: before 1.1 — fixed in 1.1
Premium Minecraft Servers List Project Premium Minecraft Servers List: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: Minecraft Servers List Lite Project Minecraft Servers List Lite 1.1; Premium Minecraft Servers List Project Premium Minecraft Servers List 2.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-5749 or the next vulnerability affects your stack