PT-2022-8642 · Tinyshop · Tinyshop

Published 2022-03-25 · Updated 2022-03-31 · CVE-2020-21554

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TinyShop version 3.1.1

Description A File Deletion issue exists in the back list parameter in controllersadmin.php, which could let a malicious user delete any file, such as install.lock, to reinstall the cms.

Recommendations For TinyShop version 3.1.1, consider restricting access to the back list parameter in controllersadmin.php to minimize the risk of exploitation. As a temporary workaround, avoid using the back list parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2020-21554

Affected Products

Tinyshop

References · 7

• 🔥 https://imgur.com/dg1DM5T · Exploit
• 🔥 https://imgur.com/pA8OWxa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21554 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21554 · Vendor Advisory
• http://tinyrise.com · Note
• http://tinyrise.com/down.html · Note
• https://t.me/cibsecurity/39541 · Telegram Post