CVE Feed

    Dashboard / CVE / CVE-2018-19550

    CVE-2018-19550

    Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI.

    Published:Nov 26, 2018
    Last Modified:Nov 21, 2024
    EPS:Nov 26, 2018
    EPSS Score:0.01976
    CVSS Score:8.8

    Affected Products

    Vendor
    Interspire
    Product
    Email Marketer

    Exploits

    https://www.exploit-db.com/exploits/46864

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2022-44790 (CVSS 7.5) — Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attack…
    CVE-2022-40777 (CVSS 8.8) — Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey a…
    CVE-2018-19651 (CVSS 6.5) — admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) v…
    CVE-2018-19549 (CVSS 8.8) — Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php…
    CVE-2018-19551 (CVSS 8.8) — Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamicc…
    CVE-2018-19552 (CVSS 8.8) — Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamicconten…
    CVE-2018-19553 (CVSS 8.8) — Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamicconte…
    CVE-2017-14322 (CVSS 9.8) — The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (I…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High