CVEvulnerability

CVE-2021-27817

9.8 CRITICAL Published 2021-03-15 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2021-03-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-434

Description

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Affected configurations

• shopxo shopxo 1.9.3

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://github.com/gongfuxiang/shopxo Product
https://github.com/h4ckdepy/vuls/blob/main/shopxo.md Broken Link
https://github.com/gongfuxiang/shopxo Product
https://github.com/h4ckdepy/vuls/blob/main/shopxo.md Broken Link

CVE-2021-27817

Description

Affected configurations

Related

Weakness · CWE (1)

References