Unauthenticated File Read in PHP Proxy

ALTO 7.5CVE-2018-19458 · GHSA-3x3m-p2wx-g7cw · Published 22/11/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
athlon1600/php-proxy-app Packagist	`≤ 3.0`	No fix yet
php-proxy php-proxy	`= 3.0.3`	No fix yet

Description

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.

NVD description

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.

References

nvd.nist.gov/vuln/detail/CVE-2018-19458 · ADVISORY
pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html · WEB
exploit-db.com/exploits/45780 · WEB
exploit-db.com/exploits/45780 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free