PT-2019-17845 · Shopxo · Shopxo

Qianxincodesafe · Publicado 2019-01-10 · Atualizado 2019-01-18 · CVE-2019-5887

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0

Description An issue in the UnlinkDir method of the FileUtil.php file allows input mishandling by the rmdir method due to unchecked input parameters. This enables attackers to delete arbitrary files using "../" directory traversal.

Recommendations For ShopXO version 1.2.0, consider implementing input validation in the UnlinkDir method of the FileUtil.php file to prevent directory traversal attacks. As a temporary workaround, restrict access to the UnlinkDir method to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-5887

Produtos afetados

Shopxo

Referências · 3

• 🔥 https://github.com/gongfuxiang/shopxo/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5887 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5887 · Nota de Segurança