CVE-2019-25632 — MEDIUM (6.2)

Vulnerability Description

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Dulldusk	Phpfilemanager	1.7.8

Related Weaknesses (CWE)

CWE-306

References

https://sourceforge.net/projects/phpfm/Product
https://www.exploit-db.com/exploits/46638ExploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/phpfilemanager-local-file-inclusion-via-indThird Party Advisory

FAQ

What is CVE-2019-25632?

CVE-2019-25632 is a vulnerability with a CVSS score of 6.2 (MEDIUM). phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. At...

How severe is CVE-2019-25632?

CVE-2019-25632 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-25632?

Check the references section above for vendor advisories and patch information. Affected products include: Dulldusk Phpfilemanager.