Design/Logic Flaw

2018-03-1914:29:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.0%

JSON

protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.

CPENameOperatorVersion
yxcmseq1.4.7

CPE	Name	Operator	Version
	yxcms	eq	1.4.7

References

github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit