Authentication flaw

2019-03-1402:29:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.3%

JSON

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.

CPENameOperatorVersion
phpsheeq1.7

CPE	Name	Operator	Version
	phpshe	eq	1.7

References

gitee.com/koyshe/phpshe/issues/ITC0C