CVE-2018-19853 in hitshop

Sumário

de MITRE

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability (that allows control over the whole web site) via the admin.php/user/add URI because a storekeeper account (which is supposed to have only privileges for commodity management) can add an administrator account.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 04/12/2018
• Divulgação: 04/12/2018
• Moderação: aceite
• Entrada: VDB-127474
• CPE: pronto
• CWE: CWE-269 (confirmado)
• CVSS: 8.8 (NVD)
• EPSS: 0.00947
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2018-19853
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-19853
• CVE Details: https://www.cvedetails.com/cve/CVE-2018-19853/