« Volver al listado

CVE-2017-15285

Estado: ModificadaAlta (8.8)—

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog, upload a .php file with an "Add File Via URL" action, and change the image's Description URL to reference the .php URL in the attachments/ directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qualiteam — X-cart

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-15285",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-12T08:29:00.617",
  "references": [
    {
      "url": "https://sxcurity.github.io/PHP%20Code%20Injection%20in%20X-Cart.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://sxcurity.github.io/PHP%20Code%20Injection%20in%20X-Cart.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog, upload a .php file with an \"Add File Via URL\" action, and change the image's Description URL to reference the .php URL in the attachments/ directory."
    },
    {
      "lang": "es",
      "value": "X-Cart 5.2.23, 5.3.1.9, 5.3.2.13 y 5.3.3 es vulnerable a la ejecución remota de código. Esta vulnerabilidad existe porque la aplicación no consigue chequear las extensiones de archivos remotos antes de guardarlos localmente. Esta vulnerabilidad la puede explotar cualquiera con acceso Vendor o superior. Una metodología de ataque es subir un archivo de imagen en la sección Attachments de un catálogo de productos, subir un archivo .php con una acción \"Add File Via URL\" y cambiar la URL de descripción de la imagen para que haga referencia a la URL .php en el directorio attachments/."
    }
  ],
  "lastModified": "2026-06-17T01:07:31.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qualiteam:x-cart:5.2.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8E903FF-8AB1-4B3D-B0A4-303E14CC343C"
            },
            {
              "criteria": "cpe:2.3:a:qualiteam:x-cart:5.3.1.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56A18495-7945-4A70-BC1C-F955A2EB010F"
            },
            {
              "criteria": "cpe:2.3:a:qualiteam:x-cart:5.3.2.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCC932CA-D539-4D75-A101-F5892FEE1A32"
            },
            {
              "criteria": "cpe:2.3:a:qualiteam:x-cart:5.3.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBC2B8FB-B386-431C-9321-36A71AECC891"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}