CVE-2017-18357
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 27%
from disclosure to weapon128 days
Published on NVDJan 15
1st PoC+128d
metasploit+114d
exploitation probability
27%top 2% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
Affected products
n/a · n/apublic PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46915cve_referencepacketstormsecurity.com/files/152995/Shopware-createInstanceFromNamedArguments-PHP-Object-Instantiation.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.