PT-2019-19853 · Phpshe · Phpshe

Wps2015 · Publicado 2019-03-14 · Atualizado 2019-03-14 · CVE-2019-9762

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7

Description A SQL Injection issue was found in the include/plugin/payment/alipay/pay.php file, specifically with the id parameter. This issue does not require any authentication to be exploited.

Recommendations For PHPSHE version 1.7, consider restricting access to the vulnerable pay.php file or avoiding the use of the id parameter in the affected endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-9762

Produtos afetados

Phpshe

Referências · 3

• 🔥 https://gitee.com/koyshe/phpshe/issues/ITC0C · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9762 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9762 · Aviso do Fabricante