CVE-2018-10362 is a critical authentication bypass vulnerability affecting phpLiteAdmin versions 1.9.5 through 1.9.7.1. It stems from a loose comparison ('==') in the login process, allowing attackers to bypass authentication by providing passwords in scientific notation (e.g., '0e1234') that PHP interprets as numerical equivalents of the legitimate password. Rated 9.8 CRITICAL (CVSSv3), this vulnerability has a low attack complexity and requires no user interaction, enabling remote attackers to achieve full compromise (confidentiality, integrity, and availability). The FAUCET Risk Score is 78/100, indicating a high potential impact. Despite its severity, there is no evidence of active exploitation, no known exploit code in Metasploit, Nuclei, or ExploitDB, and minimal community discussion or media coverage. It is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.9.5, <= 1.9.7.1CPE matchmatch criteria | cpe:2.3:a:phpliteadmin:phpliteadmin:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.