CVE-2018-19514
📋 TL;DR
CVE-2018-19514 is an arbitrary code execution vulnerability in Webgalamb email marketing software. Attackers can bypass authentication to upload malicious CSV files that get executed via PHP eval(), allowing remote code execution. All Webgalamb installations through version 7.0 are affected.
💻 Affected Systems
- Webgalamb
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the server, installing backdoors, stealing data, and using the system as a pivot point for further attacks.
Likely Case
Attacker executes arbitrary PHP code to deface websites, steal sensitive data, or install cryptocurrency miners.
If Mitigated
With proper authentication controls and file upload restrictions, exploitation would be prevented or limited to authenticated users only.
🎯 Exploit Status
Exploitation requires authentication bypass first, then CSV file upload. Public exploit code exists in disclosure references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 7.0 (specific version not specified in references)
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Upgrade Webgalamb to version after 7.0. 2. Apply any available security patches from vendor. 3. Remove or disable vulnerable versions.
🔧 Temporary Workarounds
Disable CSV upload functionality
allRemove or restrict access to CSV file upload features in subscriber.php
# Modify subscriber.php to remove eval() calls or restrict file uploads
# Add authentication checks before file processing
Implement strict file upload validation
allAdd server-side validation for uploaded CSV files
# Add file type validation in PHP
# Implement file content scanning before processing
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads and eval() exploitation attempts
- Isolate Webgalamb installation in network segment with strict outbound traffic controls
🔍 How to Verify
Check if Vulnerable:
Check Webgalamb version in admin panel or configuration files. If version is 7.0 or earlier, system is vulnerable.Check Version:
# Check version in Webgalamb admin interface or config files
# grep -r 'version' /path/to/webgalamb/installation/Verify Fix Applied:
Verify Webgalamb version is updated beyond 7.0 and test that CSV uploads no longer trigger eval() execution.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV file uploads to subscriber.php
- Multiple failed authentication attempts followed by successful admin access
- PHP eval() calls with suspicious parameters
Network Indicators:
- POST requests to subscriber.php with file uploads
- Unusual outbound connections from Webgalamb server
SIEM Query:
source="webgalamb.log" AND ("subscriber.php" AND "upload") OR ("eval" AND "CSV")🔗 References
- http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html
- http://seclists.org/fulldisclosure/2019/Jan/15
- http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html
- http://seclists.org/fulldisclosure/2019/Jan/15
