← back
CVE-2017-18357

CVE-2017-18357

EPSS 27.1%
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/152995/Shopware-createInstanceFromNamedArguments-PHP-Object-Instantiation.htmlunverifiedexploitdbwww.exploit-db.com/exploits/46915unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/152995/Shopware-createInstanceFromNamedArguments-PHP-Object-Instantiation.htmlhttps://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/https://demo.ripstech.com/projects/shopware_5.3.3