PT-2020-16935 · Sourcecodester · Sourcecodester Online Clothing Store

Published 2020-11-17 · Updated 2020-12-09 · CVE-2020-28140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Clothing Store version 1.0

Description The issue concerns an arbitrary file upload via the image upload feature of Products.php. This allows for potential malicious file uploads.

Recommendations For SourceCodester Online Clothing Store version 1.0, consider disabling the image upload feature in Products.php until a patch is available to prevent arbitrary file uploads. Restrict access to the Products.php file to minimize the risk of exploitation. Avoid using the image upload feature in Products.php until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-28140

Affected Products

Sourcecodester Online Clothing Store

References · 7

• 🔥 https://exploit-db.com/exploits/48438 · Exploit
• https://osv.dev/vulnerability/CVE-2020-28140 · Vendor Advisory
• https://sourcecodester.com/php/14185/online-clothing-store.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28140 · Security Note
• https://t.me/cvenotify/5730 · Telegram Post
• https://t.me/cibsecurity/16469 · Telegram Post
• https://t.me/cibsecurity/17353 · Telegram Post