CVE-2019-19020

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.33% chance of exploitation in the next 30 days, 82th percentile

Published

2019-12-02

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://write-up.github.io/webtitan/

References

• CVE Record
• NVD entry

Related

• CVE-2019-19019
• CVE-2019-19021
• CVE-2019-19018
• CVE-2019-19030
• CVE-2019-19017
• CVE-2019-19031