| शीर्षक | Shopwind Shopwind <=4.6 Configuration injection |
|---|
| विवरण | The Shopwind software, specifically version ≤4.6, has a critical configuration injection vulnerability within the "DefaultController.php" file. This vulnerability allows an attacker to manipulate database creation parameters during the installation process, leading to arbitrary code execution. The issue arises because the software only verifies the referer without validating the install.lock. As a result, an attacker can create a malicious database on their own server, then run a POST request to reinstall the software using this database information, effectively injecting their own code into the "config.php" file. This vulnerability enables remote code execution, posing a significant security risk. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/QHdXavkw5eDm |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 09/02/2024 04:32 PM (3 साल पहले) |
|---|
| संयम | 21/02/2024 11:43 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 254393 [Shopwind तक 4.6 Installation DefaultController.php actionCreate अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|