CVE-2019-25672

概要

参考情報

• sourceforge.net/projects/pilus · Product
• exploit-db.com/exploits/46368 · Exploit
• vulncheck.com/advisories/piluscart-sql-injection-via-send-parameter · Third Party Advisory

piluscart のその他の脆弱性

• CVE-2019-16123高 7.5In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
• CVE-2019-9769高 8.8PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.