PT-2023-2087 · Ecshop · Ecshop

Oreoze · Publicado 2023-03-06 · Atualizado 2024-05-17 · CVE-2023-1185

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ECshop versions up to 4.1.8

Description A vulnerability was found in the New Product Handler component of ECshop, allowing for unrestricted file upload. This can be exploited remotely, potentially allowing an attacker to upload arbitrary files. The exploit has been disclosed publicly.

Recommendations For ECshop versions up to 4.1.8, update to a version later than 4.1.8 to resolve the issue. As a temporary workaround, consider restricting access to the New Product Handler component to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2023-01820

CVE-2023-1185

Produtos afetados

Ecshop

Referências · 8

• 🔥❌ https://github.com/wjzdalao/ecshop4.1.8/issues/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-1185 · Aviso do Fabricante
• https://t.me/cvenotify/45584 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1185 · Nota de Segurança
• https://vuldb.com/?id.222357 · Nota
• https://bdu.fstec.ru/vul/2023-01820 · Nota de Segurança
• https://t.me/cibsecurity/59462 · Publicação no Telegram
• https://vuldb.com/?ctiid.222357 · Nota