Command Injection Vulnerability in Tosei Online Store Management System
CVE-2024-7896

8.8HIGH

Key Information:

Vendor

Tosei

Status
Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ 
Vendor
CVE Published:
17 August 2024

Badges

๐Ÿ‘พ Exploit Exists

What is CVE-2024-7896?

A critical vulnerability has been identified in the Tosei Online Store Management System, specifically in the file /cgi-bin/p1_ftpserver.php. The issue stems from improper handling of the parameter adr_txt, which could allow remote attackers to execute arbitrary commands on the server. This command injection flaw compromises the security of systems running versions 4.02 through 4.04 of the software. Publicly disclosed exploit methods may further escalate the risk, especially since the vendor has not responded to initial notifications regarding this flaw. Immediate measures should be taken to secure affected installations and mitigate potential exploitation.

Affected Version(s)

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.02

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.03

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.04

References

https://vuldb.com/?id.274904
vdb-entrytechnical-description
https://vuldb.com/?ctiid.274904
signaturepermissions-required
https://vuldb.com/?submit.387131
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • ๐Ÿ‘พ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

b0rgch3n (VulDB User)
.
CVE-2024-7896 : Command Injection Vulnerability in Tosei Online Store Management System