GitHub Advisoryadvisory · Packagist

GHSA-xx77-w6p5-xvmj ShopXO RCE Vulnerability

CRITICAL Published 2022-05-24 Modified 2023-07-13 Official page ↗
Aliases
CVE-2021-27817
Ecosystem
Packagist
Packages
shopxo/shopxo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-13

Affected packages

• Packagist shopxo/shopxo: <= 1.9.3 (no fix yet)

Description

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Related

Alias · CVE (1)

  • CVE-2021-27817 A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References