PT-2021-17629 · Shopxo · Shopxo

Published 2021-03-15 · Updated 2022-05-24 · CVE-2021-27817

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: shopxo version 1.9.3

Description: A remote command execution issue allows an attacker to upload malicious code generated by phar where the suffix is JPG. This is achieved by modifying the phar suffix, enabling the upload of malicious code.

Recommendations: For shopxo version 1.9.3, consider restricting the upload of files with modified suffixes to prevent exploitation until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-27817

GHSA-XX77-W6P5-XVMJ

Affected Products

Shopxo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-27817 · Security Note
• https://osv.dev/vulnerability/GHSA-xx77-w6p5-xvmj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27817 · Vendor Advisory
• https://github.com/gongfuxiang/shopxo · Note
• ❌ https://github.com/h4ckdepy/vuls/blob/main/shopxo.md · Note, Deleted
• https://t.me/cibsecurity/24911 · Telegram Post