X-Cart e-commerce platform updates software to defend against RCE vulnerability

guest · Aug 22, 2020

X-Cart e-commerce platform updates software to defend against RCE vulnerability
PHP deserialization flaw opened up a backdoor to e-commerce sites
August 21, 2020
https://portswigger.net/daily-swig/...-software-to-defend-against-rce-vulnerability

The developer of the X-Cart e-commerce platform has resolved an unauthenticated file write issue that posed a remote code execution (RCE) risk.

Security researcher Nicky Bloor discovered a security flaw in the X-Cart e-commerce platform that allowed an attacker to control the path and partial contents of a file write operation.
The vulnerability was fixed in versions 5.4.1.8 and 5.4.0.13 of X-Cart, allowing Bloor to publish a detailed technical write-up on Friday (August 21).
Click to expand...

Bloor told The Daily Swig that the impact of the vulnerability, which he characterised as easy to exploit, would be severe.

“This is a complete compromise of the application unless someone has gone out of their way to harden the deployment (potentially making it difficult to use and maintain in the process),” Bloor explained.
This vulnerability is specific to X-Cart and “trivial to exploit”, he added.

The retail technology firm notified users of changes to the X-Cart software related to Bloor’s findings in July through its changelog (here and here), rather than advisories.
Click to expand...

Log in or Sign up

X-Cart e-commerce platform updates software to defend against RCE vulnerability

guest Guest

Log in or Sign up

X-Cart e-commerce platform updates software to defend against RCE vulnerability

guest Guest

Useful Searches