PT-2019-17844 · Shopxo · Shopxo

Published 2019-01-10 · Updated 2020-08-24 · CVE-2019-5886

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0

Description An issue in the application allows an attacker to reinstall the database due to the lack of validation in the Add method of the Index.php file. This enables the attacker to write arbitrary code to database.php during system reinstallation.

Recommendations For ShopXO version 1.2.0, consider adding validation to the Add method in the Index.php file to prevent unauthorized database reinstallation. As a temporary workaround, restrict access to the Index.php file to minimize the risk of exploitation.

Exploit

Fix

Improper Locking

Missing Authorization

Weakness Enumeration

CWE-667

CWE-862

Related Identifiers

CVE-2019-5886

Affected Products

Shopxo

References · 3

• 🔥 https://github.com/gongfuxiang/shopxo/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5886 · Security Note