CVE-2019-18873 - CVE House
Back to Database
Status published Critical CVE-2019-18873

FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent...

Vulnerability Description

FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-18873

Credits & Attribution

No credits recorded in the NVD database.

References

More from fudforum

View All →
CVE-2022-30863
FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via...
Medium 4.8
CVE-2022-30861
FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name...
Medium 4.8
CVE-2022-30860
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload...
High 7.2
CVE-2022-28545
FUDforum 3.1.1 is vulnerable to Stored XSS....
Medium 5.4
CVE-2021-27520
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote...
Medium 6.1

Affected Vendor

Affected Software

fudforum
Vulnerable Versions:
3.0.9

Timeline

Official Publish: November 12th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.