High severity7.5NVD Advisory· Published Nov 13, 2018· Updated Jun 17, 2026
CVE-2018-19246
CVE-2018-19246
Description
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
athlon1600/php-proxyPackagist | <= 5.1.0 | — |
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/Athlon1600/php-proxy-app/issues/134nvdExploitThird Party AdvisoryWEB
- www.exploit-db.com/exploits/45861/nvdExploitThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-pc5h-m95g-v6rhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-19246ghsaADVISORY
- github.com/Athlon1600/php-proxy/pull/126ghsaWEB
- www.exploit-db.com/exploits/45861ghsaWEB
News mentions
0No linked articles in our index yet.