CVE-2018-5749
📋 TL;DR
CVE-2018-5749 is an unauthenticated remote code execution vulnerability in Minecraft Servers List plugins. Attackers can inject arbitrary PHP code through database configuration parameters during installation, potentially gaining full control of affected WordPress sites. This affects WordPress administrators using vulnerable versions of these plugins.
💻 Affected Systems
- Minecraft Servers List Lite
- Premium Minecraft Servers List
📦 What is this software?
Minecraft Servers List Lite by Minecraft Servers List Lite Project
Premium Minecraft Servers List by Premium Minecraft Servers List Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, install backdoors, steal data, deface websites, or pivot to internal networks.
Likely Case
Website defacement, malware installation, credential theft, and unauthorized access to the WordPress database and server.
If Mitigated
Limited impact with proper input validation, file permissions, and network segmentation preventing code execution or lateral movement.
🎯 Exploit Status
Exploitation is straightforward - attackers send malicious POST requests to install.php with PHP code in database parameters. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Minecraft Servers List Lite: commit c1cd164 or later; Premium Minecraft Servers List: 2.0.4 or later
Vendor Advisory: https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/
Restart Required: No
Instructions:
1. Update to patched versions via WordPress admin panel. 2. Remove any existing install.php files if they remain. 3. Verify connect.php doesn't contain malicious code. 4. Change database credentials.
🔧 Temporary Workarounds
Remove install.php
linuxDelete or restrict access to the vulnerable install.php file
rm /path/to/wordpress/wp-content/plugins/minecraft-servers-list/install.php
Restrict file permissions
linuxSet strict permissions on connect.php and other plugin files
chmod 644 /path/to/wordpress/wp-content/plugins/minecraft-servers-list/connect.php
🧯 If You Can't Patch
- Immediately remove or disable the Minecraft Servers List plugin
- Implement web application firewall rules to block requests to install.php and suspicious POST parameters
🔍 How to Verify
Check if Vulnerable:
Check if install.php exists in the plugin directory and examine its code for input sanitization of database parameters.Check Version:
Check WordPress plugin page or examine plugin header in main plugin fileVerify Fix Applied:
Verify plugin version is updated and install.php is removed or contains proper input validation/sanitization.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-content/plugins/minecraft-servers-list/install.php
- Unusual file creation in plugin directories
- Database connection errors with suspicious parameters
Network Indicators:
- HTTP requests with PHP code in database_server, database_user, database_password, or database_name parameters
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/minecraft-servers-list/install.php" AND method="POST"