CVE-2018-0658

Published: Sep 7, 2018Modified: Nov 21, 2024

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.

Affected (4)

Products: Ec Cube: Ec Cube Payment Module · Gmo Pg: Gmo Pg Payment Module

1 product

Ec Cube Payment Module

1 product

Gmo Pg Payment Module

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ec Cube Ec Cube Payment Module	Up to 2.3.17
Gmo Pg Gmo Pg Payment Module	Up to 2.3.17

Running on/with	Platform Versions
Ec Cube Ec Cube	Version 2.11

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ec Cube Ec Cube Payment Module	Up to 3.5.23
Gmo Pg Gmo Pg Payment Module	Up to 3.5.23

Running on/with	Platform Versions
Ec Cube Ec Cube	Version 2.12

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

http://jvn.jp/en/jp/JVN06372244/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

http://jvn.jp/en/jp/JVN06372244/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.