CVE-2018-14570

Published: Jul 23, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.

Affected (1)

Products: Niushop: B2b2c Multi Business

1 product

B2b2c Multi Business

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Niushop B2b2c Multi Business	Version 1.11

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/GitHaaH/issue/blob/master/Niushop.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/GitHaaH/issue/blob/master/Niushop.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.