Command Injection Vulnerability in Tosei Online Store Management System
CVE-2024-7896

8.8HIGH

Key Information:

Vendor

Tosei

Status
Online Store Management System ネット店舗管理システム
Vendor
CVE Published:
17 August 2024

Badges

👾 Exploit Exists

What is CVE-2024-7896?

A critical vulnerability has been identified in the Tosei Online Store Management System, specifically in the file /cgi-bin/p1_ftpserver.php. The issue stems from improper handling of the parameter adr_txt, which could allow remote attackers to execute arbitrary commands on the server. This command injection flaw compromises the security of systems running versions 4.02 through 4.04 of the software. Publicly disclosed exploit methods may further escalate the risk, especially since the vendor has not responded to initial notifications regarding this flaw. Immediate measures should be taken to secure affected installations and mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Online Store Management System ネット店舗管理システム 4.02

Online Store Management System ネット店舗管理システム 4.03

Online Store Management System ネット店舗管理システム 4.04

References

https://vuldb.com/?id.274904
vdb-entrytechnical-description
https://vuldb.com/?ctiid.274904
signaturepermissions-required
https://vuldb.com/?submit.387131
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

b0rgch3n (VulDB User)
JSON
.