I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.

After fixing the gap and changing the passwords, what are some ways to detect if the server has been intruded?

Is it true that the vulnerability only allows read-access? Can audit logs still be trusted?

1 Answer 1


It appears that the CVSS "Integrity" metric is "N" for None:



Even though this exploit provides read-only, it is unclear what remote files are accessible. At the very least, any passwords stored in PHP files are likely compromised.

Under Linux, you will want to verify which user is running PHP on behalf of the web server, and what permissions that user has.

The proof of concept in the vulnerability report tries to read /etc/passwd which is a common root access check.


It would be unclear if you could trust server logs if root access was possible.

  • If you down vote an answer, it would be nice to know why ;) Jun 17, 2020 at 16:54
  • not me..͏͏͏͏͏͏͏
    – Pacerier
    Jun 18, 2020 at 11:45
  • If you are implying that reading /etc/passwd requires root - that is false. Every process can read this file. The access rights are -rw-r--r-- and the file is owned by root.
    – user163495
    Nov 12, 2021 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.