GHSA-xx77-w6p5-xvmj

ghsaUSosv

ShopXO RCE Vulnerability

view advisory published 2022-05-24Licence: CC-BY-4.0

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-27817US	critical9.8	3.23% (88th)	—	2021-03-15
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying th…

references

External citations — patches, advisories, analysis.

https://github.com/h4ckdepy/vuls/blob/main/shopxo.mdWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-27817ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan