PT-2018-12585 · Niushop · Niushop B2B2C Multi-Business

Publicado 2018-07-23 · Atualizado 2018-09-20 · CVE-2018-14570

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Niushop B2B2C Multi-business basic version V1.11

Description A file upload issue in the application/shop/controller/member.php file allows remote members to upload .php files to the web server by modifying the filename and file content of an image file, such as one with a Content-Type of image/jpeg, and using it in a profile avatar field. This can result in arbitrary code execution when the uploaded .php file is requested.

Recommendations For Niushop B2B2C Multi-business basic version V1.11, consider restricting or disabling the file upload functionality in the member.php file until a patch is available to prevent arbitrary code execution. Additionally, restrict access to the profile avatar field to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-14570

Produtos afetados

Niushop B2B2C Multi-Business

Referências · 3

• 🔥 https://github.com/GitHaaH/issue/blob/master/Niushop.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14570 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14570 · Aviso do Fabricante