PT-2022-24370 · Unknown · Shopxian Cms

Albert5888 · Published 2022-09-13 · Updated 2025-03-28 · CVE-2022-38329

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopxian CMS version 3.0.0

Description A CSRF issue allows deletion of a specified column via the "index.php/contents-admin cat-finderdel-model-ContentsCat.html" endpoint, specifically when the id parameter is set to 17.

Recommendations For Shopxian CMS version 3.0.0, as a temporary workaround, consider restricting access to the "index.php/contents-admin cat-finderdel-model-ContentsCat.html" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-38329

Affected Products

Shopxian Cms

References · 7

• 🔥 https://github.com/zhangqiquan/shopxian_cms/issues/4 · Exploit
• 🔥❌ https://github.com/albert5888/CVE-Issues/blob/main/CVE-2022-38329/file.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-38329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38329 · Security Note
• https://t.me/cvenotify/116771 · Telegram Post
• https://t.me/cvenotify/115655 · Telegram Post
• https://albert5888.github.io/posts/CVE-2022-38329 · Note