PT-2023-2087 · Ecshop · Ecshop

Oreoze · Published 2023-03-06 · Updated 2024-05-17 · CVE-2023-1185

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ECshop versions up to 4.1.8

Description A vulnerability was found in the New Product Handler component of ECshop, allowing for unrestricted file upload. This can be exploited remotely, potentially allowing an attacker to upload arbitrary files. The exploit has been disclosed publicly.

Recommendations For ECshop versions up to 4.1.8, update to a version later than 4.1.8 to resolve the issue. As a temporary workaround, consider restricting access to the New Product Handler component to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-01820

CVE-2023-1185

Affected Products

Ecshop

References · 8

• 🔥❌ https://github.com/wjzdalao/ecshop4.1.8/issues/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-1185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1185 · Security Note
• https://bdu.fstec.ru/vul/2023-01820 · Security Note
• https://t.me/cvenotify/45584 · Telegram Post
• https://vuldb.com/?id.222357 · Note
• https://t.me/cibsecurity/59462 · Telegram Post
• https://vuldb.com/?ctiid.222357 · Note