Command Injection Vulnerability in Tosei Online Store Management System
CVE-2024-7897

8.8HIGH

Key Information:

Vendor

Tosei

Status
Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ 
Vendor
CVE Published:
17 August 2024

Badges

๐Ÿ‘พ Exploit Exists

What is CVE-2024-7897?

A significant command injection vulnerability has been identified in the Tosei Online Store Management System versions 4.02, 4.03, and 4.04. This vulnerability resides within the /cgi-bin/tosei_kikai.php file, where manipulation of the 'kikaibangou' argument can allow an attacker to execute arbitrary commands on the server. The attack can be initiated remotely, which heightens the risk for users of the affected product. Despite early disclosure attempts to the vendor, Tosei Corporation has not responded, leaving users exposed to potential exploits. It is crucial for organizations using these versions of the software to implement immediate mitigation strategies to safeguard their systems.

Affected Version(s)

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.02

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.03

Online Store Management System ใƒใƒƒใƒˆๅบ—่ˆ—็ฎก็†ใ‚ทใ‚นใƒ†ใƒ  4.04

References

https://vuldb.com/?id.274905
vdb-entrytechnical-description
https://vuldb.com/?ctiid.274905
signaturepermissions-required
https://vuldb.com/?submit.387406
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • ๐Ÿ‘พ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

b0rgch3n (VulDB User)
.
CVE-2024-7897 : Command Injection Vulnerability in Tosei Online Store Management System