Shopware XXE Vulnerability
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18357US | medium6.5 | Exploit | ||
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, wi… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/152995/Shopware-createInstanceFromNamedArguments-PHP-Object-Instantiation.htmlWEB
- https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxeWEB
- https://demo.ripstech.com/projects/shopware_5.3.3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-18357ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan