PT-2018-18617 · Yxcms · Yxcms

Password · Published 2018-03-19 · Updated 2019-10-03 · CVE-2018-8761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Yxcms building system (compatible cell phone) version 1.4.7

Description The issue is related to a logic flaw in the shopcarController.php file, which allows attackers to modify prices by analyzing data from packet captures before form submission.

Recommendations For version 1.4.7, consider implementing input validation and sanitization to prevent unauthorized price modifications. As a temporary workaround, restrict access to the shopcarController.php file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-8761

Affected Products

Yxcms

References · 3

• https://osv.dev/vulnerability/CVE-2018-8761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8761 · Security Note
• https://github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit · Note