CVE-2018-11569
📋 TL;DR
CVE-2018-11569 is a PHP object injection vulnerability in Eventum's ListController.php that allows remote code execution through deserialization of untrusted data. Attackers can exploit this to execute arbitrary code on the server. All Eventum 3.5.0 installations are affected.
💻 Affected Systems
- Eventum
📦 What is this software?
Eventum by Eventum Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, access sensitive data, and maintain persistent access to the server.
Likely Case
Remote code execution leading to data theft, privilege escalation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and application firewalls blocking malicious payloads.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.2
Vendor Advisory: https://github.com/eventum/eventum/releases/tag/v3.5.2
Restart Required: No
Instructions:
1. Backup your Eventum installation and database. 2. Download Eventum 3.5.2 from GitHub releases. 3. Replace the vulnerable Controller/ListController.php file. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Disable affected endpoint
allTemporarily disable or restrict access to the vulnerable ListController endpoint
# Add rewrite rule to .htaccess
RewriteRule ^controller/listcontroller\.php$ - [F,L]
Input validation filter
allAdd input validation to reject serialized data in requests
# Add to PHP configuration or application code
ini_set('unserialize_callback_func', 'spl_autoload_call');
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block serialized data in HTTP requests
- Restrict network access to Eventum installation to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if Eventum version is 3.5.0 by examining the version file or admin interfaceCheck Version:
grep -r 'APP_VERSION' config/init.php || cat VERSIONVerify Fix Applied:
Verify the Controller/ListController.php file has been updated to version 3.5.2📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to ListController.php
- PHP errors related to unserialize() function
- Unexpected process execution from web server user
Network Indicators:
- HTTP POST requests containing serialized PHP objects
- Base64 encoded payloads in request parameters
SIEM Query:
source="web_logs" AND (uri="*ListController.php*" AND (method="POST" AND size>1000))