CVE-2018-3758

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

CVE-2018-3758

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

CVE-2018-3758

CVE-2018-3758 affects the express-cart Node.js module (pre-1.1.7). The vulnerability is an unrestricted file upload via the module’s upload functionality. A privileged user can supply an attacker-controlled path and upload arbitrary files (no path/type/size validation), potentially gaining access...

PT-2018-16178 · Express · Express-Cart

Name of the Vulnerable Software and Affected Versions: express-cart versions prior to 1.1.7 Description: The issue allows a privileged user to gain access to the hosting machine through an unrestricted file upload, potentially leading to remote code execution RCE. Recommendations: For versions...

CVE-2018-3758: Improper Limitation of a Pathname to a Restricted Directory

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

Arbitrary File Upload

express-cart is vulnerable to arbitrary file upload. The vulnerability exists due to a lack of sanity check on the path and size of the uploaded file...

Node.js third-party modules: Unrestricted file upload (RCE)

I would like to report an unrestricted file upload in express-cart. It allows a user with administrative privileges to upload a file to any path. Module module name: express-cart version: 1.1.5 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully function...

Node.js third-party modules: Privilege escalation allows any user to add an administrator

I would like to report privilege escalation in the npm module express-cart. It allows a normal user to add another user with administrator privileges. Module module name: express-cart version: 1.1.5 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully...