PT-2019-17844 · Shopxo · Shopxo

Publicado 2019-01-10 · Atualizado 2020-08-24 · CVE-2019-5886

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0

Description An issue in the application allows an attacker to reinstall the database due to the lack of validation in the Add method of the Index.php file. This enables the attacker to write arbitrary code to database.php during system reinstallation.

Recommendations For ShopXO version 1.2.0, consider adding validation to the Add method in the Index.php file to prevent unauthorized database reinstallation. As a temporary workaround, restrict access to the Index.php file to minimize the risk of exploitation.

Exploit

Correção

Improper Locking

Missing Authorization

Enumeração de Fraquezas

CWE-667

CWE-862

Identificadores relacionados

CVE-2019-5886

Produtos afetados

Shopxo

Referências · 3

• 🔥 https://github.com/gongfuxiang/shopxo/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5886 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5886 · Nota de Segurança