CVE-2018-1999022

Summary

CVE	CVE-2018-1999022
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-07-23 16:29:00 UTC
Updated	2018-10-03 20:01:00 UTC
Description	PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

Risk And Classification

Problem Types: CWE-94

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Civicrm	Civicrm	5.3.0	All	All	All
Application	Civicrm	Civicrm	5.3.0	All	All	All
Application	Civicrm	Civicrm	All	All	All	All
Application	Html Quickform Project	Html Quickform	3.2.14	All	All	All
Application	Html Quickform Project	Html Quickform	3.2.14	All	All	All

References

Reference	Source	Link	Tags
CIVI-SA-2018-07: Remote Code Execution in QuickForm \| CiviCRM	CONFIRM	civicrm.org	Third Party Advisory
Error 404	CONFIRM	blog.pear.php.net	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

690570 Free Berkeley Software Distribution (FreeBSD) Security Update for moodle (074cb225-bb2d-11e8-90e1-fcaa147e860e)