ECshop Backup Database database.php unrestricted upload
CVE-2023-1184

8.8HIGH

Key Information:

Vendor

Shopex

Status
ECshop
Vendor
CVE Published:
6 March 2023

What is CVE-2023-1184?

A security vulnerability has been identified in ECshop, specifically in the Backup Database Handler within the file admin/database.php. This issue facilitates unrestricted file uploads, potentially allowing attackers to upload malicious files and execute unauthorized actions remotely. Given that the exploit has been publicly disclosed, it is essential for users of ECshop versions up to 4.1.8 to take immediate action to protect their systems from potential exploits.

Affected Version(s)

ECshop 4.1.0

ECshop 4.1.1

ECshop 4.1.2

References

https://vuldb.com/?id.222356
vdb-entry
https://vuldb.com/?ctiid.222356
signaturepermissions-required
https://github.com/wjzdalao/ecshop4.1.8/issues/1
broken-linkexploitissue-tracking

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OreoZe (VulDB User)
.