PT-2018-18617 · Yxcms · Yxcms

Password · Publicado 2018-03-19 · Atualizado 2019-10-03 · CVE-2018-8761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Yxcms building system (compatible cell phone) version 1.4.7

Description The issue is related to a logic flaw in the shopcarController.php file, which allows attackers to modify prices by analyzing data from packet captures before form submission.

Recommendations For version 1.4.7, consider implementing input validation and sanitization to prevent unauthorized price modifications. As a temporary workaround, restrict access to the shopcarController.php file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-8761

Produtos afetados

Yxcms

Referências · 3

• https://github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit · Nota
• https://osv.dev/vulnerability/CVE-2018-8761 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8761 · Nota de Segurança