CVE-2018-13981 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2018-13981?

CVE-2018-13981 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows unauthenticated attackers to upload malicious PHP files with .php5 or .phtml extensions to websites built with Zeta Producer Desktop CMS, leading to remote code execution. It affects websites using the default formmailer widget in vulnerable versions. Attackers can gain full control of affected web servers.

📋 TL;DR

This vulnerability allows unauthenticated attackers to upload malicious PHP files with .php5 or .phtml extensions to websites built with Zeta Producer Desktop CMS, leading to remote code execution. It affects websites using the default formmailer widget in vulnerable versions. Attackers can gain full control of affected web servers.

💻 Affected Systems

Products:

Zeta Producer Desktop CMS

Versions: Versions before 14.2.1

Operating Systems: Windows, Linux (if CMS is deployed on Linux web servers)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects websites using the default formmailer widget component. The vulnerability exists in the CMS-generated websites, not necessarily the CMS software itself.

📦 What is this software?

Zeta Producer Desktop Cms by Zeta Producer

View all CVEs affecting Zeta Producer Desktop Cms →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the web server, data theft, installation of backdoors, lateral movement to internal networks, and ransomware deployment.

🟠

Likely Case

Webshell installation leading to data exfiltration, defacement, or use as part of a botnet.

🟢

If Mitigated

Limited impact if file uploads are blocked at network perimeter or web application firewall level.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts available. Attack requires no authentication and uses simple HTTP file upload.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 14.2.1

Vendor Advisory: https://www.zeta-producer.com/en/security-advisory.html

Restart Required: No

Instructions:

1. Upgrade Zeta Producer Desktop CMS to version 14.2.1 or later. 2. Regenerate and redeploy all affected websites using the patched version. 3. Remove any previously uploaded malicious files.

🔧 Temporary Workarounds

Block PHP extensions at web server

all

Configure web server to block execution of .php5 and .phtml files

For Apache: Add 'AddHandler cgi-script .php5 .phtml' to .htaccess
For Nginx: location ~ \.(php5|phtml)$ { deny all; }

Disable formmailer widget

all

Remove or disable the vulnerable formmailer component from websites

Remove /assets/php/formmailer/ directory from web root

🧯 If You Can't Patch

Implement strict file upload filtering at WAF or reverse proxy level
Monitor for suspicious file uploads to /assets/php/formmailer/ directory

🔍 How to Verify

Check if Vulnerable:

Check if website contains /assets/php/formmailer/SendEmail.php and test uploading .php5 file to that endpoint

Check Version:

Check CMS about dialog or version.txt file in installation directory

Verify Fix Applied:

Verify CMS version is 14.2.1+ and test that .php5/.phtml uploads are properly blocked

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /assets/php/formmailer/SendEmail.php with .php5/.phtml files
File creation in upload directories with .php5/.phtml extensions

Network Indicators:

Unusual outbound connections from web server following file uploads
HTTP requests with suspicious User-Agents to formmailer endpoint

SIEM Query:

source="web_logs" AND uri="/assets/php/formmailer/SendEmail.php" AND (file_extension=".php5" OR file_extension=".phtml")

📊 Metadata

CVE ID: CVE-2018-13981

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: July 16, 2018

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html Exploit,Third Party Advisory,VDB Entry
https://www.exploit-db.com/exploits/45016/ Exploit,Third Party Advisory,VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ Exploit,Third Party Advisory
http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html Exploit,Third Party Advisory,VDB Entry
https://www.exploit-db.com/exploits/45016/ Exploit,Third Party Advisory,VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2018-13981, you might also want to check these: