PT-2020-20432 · Litecart · Litecart

Published 2020-02-25 · Updated 2021-07-21 · CVE-2020-9017

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.2.2

Description The issue allows CSV injection via a customer's profile. This can be exploited by injecting malicious data into CSV files, potentially leading to security breaches.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to customer profile editing to minimize the risk of exploitation. Avoid using the profile functionality in the affected versions until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-9017

Affected Products

Litecart

References · 5

• 🔥 https://uploadboy.com/7njf43f167is/384/mp4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9017 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9017 · Vendor Advisory
• https://cert.ikiu.ac.ir/public-files/pages/attachments/11/e8e09da3c5702511520810527af5b313.pdf · Note
• https://t.me/cvenotify/1218 · Telegram Post