Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Hisiphp 1.0.8 lets attackers run code via plugin name

CVE-2018-17827 · published 8 years ago
Summary

The Hisiphp content management system version 1.0.8 accepts a plugin name that is later inserted into its admin code without proper checks. An attacker who can change a plugin’s name could inject malicious PHP commands, allowing them to run code on the server. Update to a patched version or apply input validation to prevent special characters in plugin names.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hisiphp hisiphp 1.0.8
cpe:2.3:a:hisiphp:hisiphp:1.0.8:*:*:*:*:*:*:*
Original advisory text
HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php.
HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published1 Oct 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-17827 · NVD
Track software like this
Free during beta