Likeshop HTTP POST Request File.php userFormImage unrestricted upload
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.3epss 71%
from disclosure to weapon155 days
Published on NVDJan 9
1st PoC+155d
VulnCheck+13d
exploitation probability
71%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
n/a · Likeshoppublic PoCs found — 1
vulncheckvulncheck.com/xdb/8bd8fe9c36e8unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.