LiveActive security incident?Get immediate response
CVE Record

CVE-2018-14579: GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote...

GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a legacy GolemCMS issue. If the installation directory is left reachable after setup, a remote attacker may execute arbitrary PHP code or read installation SQL data. The risk is serious for any internet-facing instance, but the condition is specific: the install/ directory must still be active.

Executive priority

Treat this as urgent if any GolemCMS site is still internet-facing. The business risk is remote code execution on a legacy CMS, but urgency depends on whether install/ is exposed. Confirm exposure first, then remove access or retire the system.

Technical view

CVE-2018-14579 affects GolemCMS through 2008-12-24 when install/ remains active after installation. The CVE description says remote attackers can place PHP code through the Database Information table-prefix field, or obtain sensitive information by directly requesting install/install.sql. No CVSS, CWE, or vendor patch details are provided in the bundle.

Likely exposure

Likely exposure is limited to old GolemCMS deployments with install/ still web-accessible. The source bundle does not identify modern vendor packages, CPEs, hosting defaults, or confirmed affected downstream products.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation evidence. Public reference material exists, but the provided sources do not establish exploitation in the wild, exploit prevalence, or current attacker targeting.

Researcher notes

Evidence is sparse: the CVE record provides the core behavior, date range, and one external reference. There is no CVSS vector, CWE mapping, CPE list, KEV status, or named patch in the provided bundle. Avoid broad claims beyond exposed GolemCMS install directories.

Mitigation direction

  • Remove or restrict web access to install/ after confirming installation is complete.
  • Confirm install/install.sql is not reachable from the internet.
  • Check archived vendor or project guidance before changing legacy application files.
  • If GolemCMS remains in use, prioritize migration from the unsupported legacy platform.
  • Review backups and deployments for accidentally restored install/ directories.

Validation and detection

  • Inventory public web roots for GolemCMS and exposed install/ directories.
  • Confirm direct web access to install/install.sql is blocked.
  • Review web logs for requests targeting install/ and install/install.sql.
  • Validate in staging that removing install/ does not break normal site functions.
  • Document any legacy instance owner, location, and retirement plan.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-14579 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.