PT-2019-17845 · Shopxo · Shopxo

Qianxincodesafe · Published 2019-01-10 · Updated 2019-01-18 · CVE-2019-5887

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0

Description An issue in the UnlinkDir method of the FileUtil.php file allows input mishandling by the rmdir method due to unchecked input parameters. This enables attackers to delete arbitrary files using "../" directory traversal.

Recommendations For ShopXO version 1.2.0, consider implementing input validation in the UnlinkDir method of the FileUtil.php file to prevent directory traversal attacks. As a temporary workaround, restrict access to the UnlinkDir method to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-5887

Affected Products

Shopxo

References · 3

• 🔥 https://github.com/gongfuxiang/shopxo/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5887 · Security Note