Arbitrary File Upload Vulnerability in ShopXO Payment Plugin
CVE-2020-26007

7.8HIGH

Key Information:

Vendor

Shopxo

Status
Shopxo
Vendor
CVE Published:
20 March 2022

What is CVE-2020-26007?

An arbitrary file upload vulnerability exists in the upload payment plugin of ShopXO v1.9.0, allowing attackers to upload crafted PHP files which can lead to remote code execution on the server. This security issue can potentially allow malicious actors to compromise the affected systems, gain unauthorized access, and execute harmful scripts.

References

https://github.com/gongfuxiang/shopxo/issues/48
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.