PT-2019-19853 · Phpshe · Phpshe

Wps2015 · Published 2019-03-14 · Updated 2019-03-14 · CVE-2019-9762

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7

Description A SQL Injection issue was found in the include/plugin/payment/alipay/pay.php file, specifically with the id parameter. This issue does not require any authentication to be exploited.

Recommendations For PHPSHE version 1.7, consider restricting access to the vulnerable pay.php file or avoiding the use of the id parameter in the affected endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-9762

Affected Products

Phpshe

References · 3

• 🔥 https://gitee.com/koyshe/phpshe/issues/ITC0C · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9762 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9762 · Vendor Advisory