ShopXO RCE Vulnerability

2022-05-2417:44:35

Google

osv.dev

0.005 Low

EPSS

Percentile

76.2%

JSON

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

CPENameOperatorVersion
shopxo/shopxoeq1.9.2
shopxo/shopxoeq1.1.0
shopxo/shopxoeq1.9.0
shopxo/shopxoeq1.9.3
shopxo/shopxoeq1.8.1
shopxo/shopxoeq1.2.0
shopxo/shopxoeq1.6.0
shopxo/shopxoeq1.8.0
shopxo/shopxoeq1.3.0
shopxo/shopxoeq1.5.0

Name	Operator	Version
shopxo/shopxo	eq	1.9.2
shopxo/shopxo	eq	1.1.0
shopxo/shopxo	eq	1.9.0
shopxo/shopxo	eq	1.9.3
shopxo/shopxo	eq	1.8.1
shopxo/shopxo	eq	1.2.0
shopxo/shopxo	eq	1.6.0
shopxo/shopxo	eq	1.8.0
shopxo/shopxo	eq	1.3.0
shopxo/shopxo	eq	1.5.0