LiveActive security incident?Get immediate response
CVE Record

CVE-2018-19222: An issue was discovered in LAOBANCMS 2.0.

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-19222 describes an admin password reset flaw in LAOBANCMS 2.0. A specific installer-related page can reset the administrator password even when an install marker file exists. If exposed on a live website, this could let an unauthenticated attacker take over the CMS administrator account.

Executive priority

Prioritize any public LAOBANCMS 2.0 instance because the described outcome is administrator account takeover. Urgency is high for exposed systems, but organization-wide priority depends on whether this niche CMS is actually deployed.

Technical view

The vulnerability is tied to LAOBANCMS 2.0 installation logic. The CVE states that /install/mysql_hy.php with reset-related parameters can reset the admin password despite install.txt being present. The supplied sources do not provide CVSS, CWE, affected CPEs, patch status, or authenticated-versus-unauthenticated detail beyond the described reset behavior.

Likely exposure

Exposure is most likely on websites still running LAOBANCMS 2.0 with installer files reachable from the internet. The source bundle does not establish broader product versions, hosted-service exposure, or default deployment prevalence.

Exploitation context

The CVE is not listed as CISA KEV in the supplied bundle, and no cited source confirms active exploitation. The referenced public write-up appears to describe the reset condition, so defenders should treat exposed installer paths as sensitive.

Researcher notes

Evidence is sparse: the CVE record names LAOBANCMS 2.0 and a reset path, but gives no CVSS, CWE, fixed version, or maintainer advisory. Avoid assuming other versions are affected without separate confirmation.

Mitigation direction

  • Inventory internet-facing sites for LAOBANCMS 2.0.
  • Check vendor or project guidance for patched versions or official mitigation.
  • Restrict public access to installation paths while remediation is planned.
  • Remove unused installer components only if supported by the application owner.
  • Rotate administrator credentials after confirming exposure or suspicious access.
  • Monitor access logs for unexpected requests to the installer path.

Validation and detection

  • Confirm whether LAOBANCMS 2.0 is deployed, especially on public websites.
  • Review web server logs for requests to the affected installer endpoint.
  • Verify installer paths are blocked from unauthenticated external access.
  • Check admin account change history for unexpected password resets.
  • Document any uncertainty where version or installer exposure cannot be proven.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-19222 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.