CVE-2021-27817 | BDVDB-2026-150485 Detail

Description#

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/gongfuxiang/shopxo
https://github.com/h4ckdepy/vuls/blob/main/shopxo.md

Exploit#

No public exploit known

History#

Version 12021-03-15Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.