CVE-2018-14570

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a…

published July 23, 2018

CVSS
—
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01765 · 77.8th percentile
Published
2018-07-23T20:00Z
EPSS history
Timeline
  • 23 JUL 20:00Z
    A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a…
    cvelistv5