CVE-2018-18713
📋 TL;DR
This vulnerability allows remote attackers to read arbitrary files on PHPYun systems through directory traversal in the down_sql_action() function. Attackers can access sensitive files like configuration files, password files, and source code by manipulating the 'name' parameter. All PHPYun 4.6 installations with the vulnerable component exposed are affected.
💻 Affected Systems
- PHPYun
📦 What is this software?
Phpyun by Phpyun
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files containing database credentials, followed by database takeover and potential lateral movement.
Likely Case
Exfiltration of sensitive configuration files, database credentials, and application source code leading to data breaches.
If Mitigated
Limited impact with proper file permissions and web server restrictions preventing access to critical system files.
🎯 Exploit Status
Simple directory traversal attack requiring only web access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PHPYun 4.7 or later
Vendor Advisory: Not publicly documented by vendor
Restart Required: No
Instructions:
1. Upgrade to PHPYun 4.7 or later. 2. If upgrade not possible, manually patch /admin/model/database.class.php by adding input validation to the down_sql_action() function.
🔧 Temporary Workarounds
Restrict admin directory access
allBlock external access to the /admin/ directory using web server configuration
# For Apache: add to .htaccess
Deny from all
# For Nginx: add to server block
location /admin/ { deny all; }
Input validation patch
allAdd directory traversal protection to the vulnerable function
# In /admin/model/database.class.php, modify down_sql_action()
# Add: if (strpos($name, '..') !== false) { die('Invalid request'); }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block directory traversal patterns
- Restrict file system permissions to prevent reading sensitive files even if vulnerability is exploited
🔍 How to Verify
Check if Vulnerable:
Attempt to access /admin/index.php?m=database&c=down_sql&name=../../../../etc/passwd and check if file contents are returned.Check Version:
Check PHPYun version in admin panel or look for version information in source files.Verify Fix Applied:
Test the same exploit attempt after patching - should return error or empty response.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'm=database&c=down_sql&name=' with directory traversal patterns
- Multiple failed attempts to access sensitive file paths
Network Indicators:
- Unusual GET requests to admin endpoints with ../ patterns
- Traffic spikes to /admin/index.php with database parameters
SIEM Query:
source="web_logs" AND uri="*m=database&c=down_sql&name=*" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*")