CVE-2018-19518
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap...
- Published
- Nov 25, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Nov 29, 2018
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
Sources
3- CVE-2018-19518Exploit
Docker-based lab environment demonstrating CVE-2018-19518 RCE exploit via PHP IMAP extension, with step-by-step usage and WAF integration for educational testing.
- EXP_CVE-2018-19518Exploit
Python exploit script for CVE-2018-19518, targeting a PHP imap_open() vulnerability to execute remote commands and spawn reverse shells on authorized systems.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.