PT-2018-8996 · Ec Cube+1 · Ec-Cube Payment Module+1

Gen Sato · Published 2018-09-07 · Updated 2018-11-20 · CVE-2018-0658

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier

Description The issue allows an attacker with administrative rights to execute arbitrary PHP code on the server. This can be achieved via unspecified vectors, indicating a potential input validation problem.

Recommendations For EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17. For GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-0658

Affected Products

Ec-Cube Payment Module

Gmo-Pg Payment Module

References · 3

• https://osv.dev/vulnerability/CVE-2018-0658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0658 · Security Note
• http://jvn.jp/en/jp/JVN06372244/index.html · Note