Command Injection Vulnerability in Tosei Online Store Management System
CVE-2024-7896

8.8HIGH

Key Information:

Vendor: Tosei
Status: Online Store Management System ネット店舗管理システム
Vendor: CVE Published:; 17 August 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A critical vulnerability has been identified in the Tosei Online Store Management System, specifically in the file /cgi-bin/p1_ftpserver.php. The issue stems from improper handling of the parameter adr_txt, which could allow remote attackers to execute arbitrary commands on the server. This command injection flaw compromises the security of systems running versions 4.02 through 4.04 of the software. Publicly disclosed exploit methods may further escalate the risk, especially since the vendor has not responded to initial notifications regarding this flaw. Immediate measures should be taken to secure affected installations and mitigate potential exploitation.

Affected Version(s)

Online Store Management System ネット店舗管理システム 4.02

Online Store Management System ネット店舗管理システム 4.03

Online Store Management System ネット店舗管理システム 4.04

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-7896 - Proof of Concept