CVE-2019-5886

2019-01-1014:29:00

Google

osv.dev

7.3 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.3%

JSON

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation.

CPENameOperatorVersion
shopxoeq1.2.0
shopxoeq1.1.0

CPE	Name	Operator	Version
	shopxo	eq	1.2.0
	shopxo	eq	1.1.0

References

github.com/gongfuxiang/shopxo/issues/1