PT-2019-19014 · Webiness · Webiness Inventory

Mehmet Emiroglu · Published 2019-05-14 · Updated 2019-05-22 · CVE-2019-8404

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Webiness Inventory version 2.3

Description An issue in the ProductModel component allows for Arbitrary File Upload through a crafted product image during new product creation. This enables an attacker to steal site information using an installed executable file or modify page contents.

Recommendations For Webiness Inventory version 2.3, consider disabling the product image upload feature in the ProductModel component until a patch is available to prevent Arbitrary File Upload. Restrict access to the product creation functionality to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-8404

Affected Products

Webiness Inventory

References · 5

• 🔥 https://exploit-db.com/exploits/46405 · Exploit
• 🔥 http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-8404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8404 · Security Note
• https://sourceforge.net/projects/webinessinventory/files · Note