Command Injection Vulnerability in Tosei Online Store Management System
CVE-2024-7897

8.8HIGH

Key Information:

Vendor: Tosei
Status: Online Store Management System ネット店舗管理システム
Vendor: CVE Published:; 17 August 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant command injection vulnerability has been identified in the Tosei Online Store Management System versions 4.02, 4.03, and 4.04. This vulnerability resides within the /cgi-bin/tosei_kikai.php file, where manipulation of the 'kikaibangou' argument can allow an attacker to execute arbitrary commands on the server. The attack can be initiated remotely, which heightens the risk for users of the affected product. Despite early disclosure attempts to the vendor, Tosei Corporation has not responded, leaving users exposed to potential exploits. It is crucial for organizations using these versions of the software to implement immediate mitigation strategies to safeguard their systems.

Affected Version(s)

Online Store Management System ネット店舗管理システム 4.02

Online Store Management System ネット店舗管理システム 4.03

Online Store Management System ネット店舗管理システム 4.04

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-7897 - Proof of Concept