{"uuid": "bbc18b5b-67cc-4769-9fb2-83a3d574d55e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8518", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/horde_csv_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Andrea Cardaci \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The Horde_Data module version 2.1.4 (and before) present in Horde\\n          Groupware version 5.2.22 allows authenticated users to inject\\n          arbitrary PHP code thus achieving RCE on the server hosting the web\\n          application.\", \"disclosure_date\": \"2020-02-07\", \"fullname\": \"exploit/multi/http/horde_csv_rce\", \"is_install_path\": true, \"mod_time\": \"2023-02-10 18:04:31 +0000\", \"name\": \"Horde CSV import arbitrary PHP code execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/horde_csv_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/horde_csv_rce\", \"references\": [\"CVE-2020-8518\", \"URL-https://cardaci.xyz/advisories/2020/03/10/horde-groupware-webmail-edition-5.2.22-rce-in-csv-data-import/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:49.782571Z"}