~ / search / GHSA-xx77-w6p5-xvmj

GHSA-xx77-w6p5-xvmj

ShopXO RCE Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-27817

Packages

EcosystemPackageAffectedFixed in
Packagist shopxo/shopxo <= 1.9.3 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

References

External links from the advisory. They lead to third-party sites.