PT-2017-8339 · Shopware · Shopware

Published 2017-04-21 · Updated 2022-05-14 · CVE-2016-3109

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.1.5

Description The issue allows remote attackers to execute arbitrary code via the "backend/Login/load/" script.

Recommendations For versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-3109

GHSA-CJ2F-96JQ-PHPP

Affected Products

Shopware

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/CVE-2016-3109.yaml · Exploit
• 🔥 http://packetstormsecurity.com/files/136781/Shopware-Remote-Code-Execution.html · Exploit
• https://github.com/shopware/shopware/commit/d73e9031a5b2ab6e918eb86d1e2b2e873cd3558d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-3109 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj2f-96jq-phpp · Vendor Advisory
• https://web.archive.org/web/20200814090044/http://securityfocus.com/archive/1/538173/100/0/threaded · Note
• http://securityfocus.com/bid/97979 · Note
• http://securityfocus.com/archive/1/538173/100/0/threaded · Note
• https://community.shopware.com/_detail_1918.html · Note
• https://web.archive.org/web/20210125193827/http://securityfocus.com/bid/97979 · Note