Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14eDc3LXc2cDUteHZtas4AAn1j

ShopXO RCE Vulnerability

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Permalink: https://github.com/advisories/GHSA-xx77-w6p5-xvmj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eDc3LXc2cDUteHZtas4AAn1j
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 10 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-xx77-w6p5-xvmj, CVE-2021-27817
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-27817
• https://github.com/h4ckdepy/vuls/blob/main/shopxo.md
• https://github.com/advisories/GHSA-xx77-w6p5-xvmj

Repository: https://github.com/h4ckdepy/vuls
Blast Radius: 1.0

Affected Packages