CVE-2019-9002
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary PHP code on Tiny Issue and pixeline Bugs installations. Attackers can exploit the install/config-setup.php file if it remains accessible after installation, affecting all users who haven't removed the installer files.
💻 Affected Systems
- Tiny Issue
- pixeline Bugs
📦 What is this software?
Bugs by Pixeline
Tiny Issue by Tiny Issue Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, malware deployment, or system takeover.
Likely Case
Webshell installation leading to persistent access, data exfiltration, or lateral movement within the network.
If Mitigated
No impact if installer files are properly removed after installation.
🎯 Exploit Status
Simple HTTP POST request with PHP code in database_host parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Remove installer files after installation
Vendor Advisory: https://github.com/mikelbring/tinyissue/issues/237
Restart Required: No
Instructions:
1. Delete the entire 'install' directory after installation completes. 2. Verify no install files remain in web-accessible directories.
🔧 Temporary Workarounds
Remove Installer Files
linuxDelete the vulnerable install/config-setup.php file and entire install directory
rm -rf /path/to/webroot/install/
Block Access via Web Server
allConfigure web server to deny access to install directory
# Apache: <Directory /path/to/webroot/install> Order deny,allow Deny from all </Directory>
# Nginx: location ~ /install/ { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Deploy WAF rules to block requests containing PHP code patterns
🔍 How to Verify
Check if Vulnerable:
Check if /install/config-setup.php exists in webroot: ls -la /path/to/webroot/install/config-setup.phpCheck Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Confirm install directory is removed or inaccessible: curl -I http://yoursite/install/config-setup.php should return 404📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /install/config-setup.php
- Log entries containing 'database_host' parameter with PHP code patterns
Network Indicators:
- POST requests to install/config-setup.php with suspicious payloads
- Outbound connections from web server to unknown IPs
SIEM Query:
web.url = "*install/config-setup.php" AND http.method = "POST"