CVE-2024-25415

Опубликовано: 16 фев. 2024

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.

Ссылки

https://github.com/capture0x/Phoenix
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html
Exploit
Third Party Advisory
https://vulners.com/zdt/1337DAY-ID-39172
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/51957
Exploit
Third Party Advisory
https://github.com/capture0x/Phoenix
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html
Exploit
Third Party Advisory
https://vulners.com/zdt/1337DAY-ID-39172
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/51957
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phoenixcart:ce_phoenix_cart:1.0.8.20:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06333

Низкий

7.2 High

CVSS3

Дефекты

CWE-94

Связанные уязвимости

GHSA-pq2x-v8q9-52vx

CVSS3: 7.2

github

почти 2 года назад

BDU:2024-02825

CVSS3: 8.8

fstec

около 2 лет назад

Уязвимость сценария /admin/define_language.php программного обеспечения для электронной коммерции CE Phoenix (CE PhoenixCart), позволяющая нарушителю выполнить произвольный код