p PatchFirst

CVE-2024-6524

CVE-2024-6524 · ShopXO Uploader.php server-side request forgery

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF.

CVSS 5.3 · Medium · EPSS 0.5%

Published
Updated

Stack: php

Affected products and versions

  • shopxo

    Versions
    • 6.0: Affected
    • 6.1: Affected

    No fix published

  • shopxo/shopxo Packagist

    Versions
    • 2.1.0
    • v1.1.0
    • v1.2.0
    • v1.3.0
    • v1.4.0
    • v1.5.0
    • v1.6.0
    • v1.7.0
    • v1.8.0
    • v1.8.1
    • v1.9.0
    • v1.9.1
    • v1.9.2
    • v1.9.3
    • v2.0.0
    • v2.0.1
    • v2.0.2
    • v2.0.3
    • v2.2.0
    • v2.2.1
    • v2.2.2
    • v2.2.3
    • v2.2.4
    • v2.2.5
    • v2.2.6
    • v2.2.7
    • v2.2.8
    • v2.2.9
    • v2.3.0
    • v2.3.1
    • v2.3.2
    • v2.3.3
    • v3.0.0
    • v3.0.1
    • v3.0.2
    • v3.0.3
    • v4.0.0
    • v5.0.0
    • v6.0.0
    • v6.1.0
    Affected ranges
    • ECOSYSTEM: ≤ 6.1.0

    No fix published

Original sources

Check your server →