CVE-2018-19550

Vulnerability

Interspire Email Marketer versions through 6.1.6 contain an arbitrary file upload vulnerability in the surveys_submit.php script. The "create survey and submit survey" operation does not properly validate uploaded files, allowing an attacker to upload a .php file. The uploaded file is stored under the admin/temp/surveys/ directory and becomes directly accessible via the web server. No authentication is required to trigger the upload [1].

Exploitation

An attacker can send a crafted HTTP POST request to surveys_submit.php with a malicious PHP file (e.g., a web shell) as part of the survey submission. The file is saved to the admin/temp/surveys/ path with a predictable or user-controlled filename. The attacker then accesses the uploaded file directly via its URL, causing the PHP code to execute on the server [1].

Impact

Successful exploitation allows remote code execution in the context of the web server user. The attacker can execute arbitrary PHP commands, read or modify files, access the database, and potentially escalate privileges to fully compromise the Interspire Email Marketer installation and the underlying server.

Mitigation

As of the publication date (2018-11-26), no official patch has been released for this vulnerability. Users should upgrade to a version later than 6.1.6 if available, or apply strict access controls to the surveys_submit.php endpoint (e.g., require authentication, disable the script, or use a web application firewall to block malicious file uploads). The vendor may have addressed this in subsequent releases; consult the official changelog.