CVE-2018-19410
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- November 21, 2018
- Published Date
- November 21, 2018
- Last Updated
- February 04, 2025
- Vendor
- n/a
- Product
- n/a
- Description
- PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2025-02-04 00:00:00 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
himash/CVE-2018-19410-POC
Type: github • Created: 2024-01-25 07:20:19 UTC • Stars: 2
Proof of concept for the vulnerability CVE-2018-19410