PT-2019-19014 · Webiness · Webiness Inventory

Mehmet Emiroglu · Publicado 2019-05-14 · Atualizado 2019-05-22 · CVE-2019-8404

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Webiness Inventory version 2.3

Description An issue in the ProductModel component allows for Arbitrary File Upload through a crafted product image during new product creation. This enables an attacker to steal site information using an installed executable file or modify page contents.

Recommendations For Webiness Inventory version 2.3, consider disabling the product image upload feature in the ProductModel component until a patch is available to prevent Arbitrary File Upload. Restrict access to the product creation functionality to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-8404

Produtos afetados

Webiness Inventory

Referências · 5

• 🔥 https://exploit-db.com/exploits/46405 · Exploit
• 🔥 http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-8404 · Aviso do Fabricante
• https://sourceforge.net/projects/webinessinventory/files · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-8404 · Nota de Segurança