CVE-2018-10429
📋 TL;DR
CVE-2018-10429 is a critical remote code execution vulnerability in Cosmo CMS that allows attackers to execute arbitrary PHP code during installation. Attackers can inject malicious PHP code through the Database Prefix field in install.php, leading to complete system compromise. This affects all users running Cosmo 1.0.0Beta6 who have not completed installation or have left install.php accessible.
💻 Affected Systems
- Cosmo CMS
📦 What is this software?
Cosmo by Cosmocms
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full administrative access, data theft, backdoor installation, and lateral movement to other systems.
Likely Case
Webshell deployment leading to website defacement, data exfiltration, and use as a pivot point for further attacks.
If Mitigated
Limited impact if install.php is removed after installation and proper file permissions are set.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to access install.php and inject PHP code in the Database Prefix field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.0.0Beta6
Vendor Advisory: https://github.com/CosmoCMS/Cosmo/issues/405
Restart Required: No
Instructions:
1. Upgrade to latest Cosmo CMS version. 2. If using 1.0.0Beta6, manually delete install.php after installation. 3. Ensure proper input validation is implemented for all installation fields.
🔧 Temporary Workarounds
Remove install.php
allDelete the vulnerable installation script after successful installation
rm /path/to/cosmo/install.php
Restrict access to install.php
allUse web server configuration to block access to install.php
# Apache: add to .htaccess
<Files "install.php">
Order allow,deny
Deny from all
</Files>
# Nginx: add to server block
location ~ /install\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Immediately delete install.php file from web root after installation
- Implement strict input validation and sanitization for all installation form fields
🔍 How to Verify
Check if Vulnerable:
Check if install.php exists in Cosmo installation directory and if Cosmo version is 1.0.0Beta6Check Version:
Check Cosmo version in configuration files or admin panelVerify Fix Applied:
Confirm install.php is deleted or inaccessible, and verify Cosmo version is newer than 1.0.0Beta6📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to install.php
- Database prefix field containing PHP code patterns
- Web server errors related to PHP execution
Network Indicators:
- HTTP requests to install.php after installation
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/install.php" OR uri LIKE "%install.php%") AND (method="POST" OR status_code=200)