CVE-2019-19020

Published: Dec 2, 2019Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.

Affected (1)

Products: Titanhq: Webtitan

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Titanhq Webtitan	Before 5.18

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://write-up.github.io/webtitan/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.webtitan.com/resources/product-updates/

Source: cve@mitre.org

Release NotesVendor Advisory

https://write-up.github.io/webtitan/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.webtitan.com/resources/product-updates/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.