PT-2018-10198

CVE-2018-10942

·

Published

2018-05-10

·

Updated

2018-06-13

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.4.0.1 through 1.6.1.18 Attribute Wizard addon version 1.6.9
Description The issue allows remote attackers to execute arbitrary code by uploading a .phtml file through the file upload.php in the Attribute Wizard addon.
Recommendations For PrestaShop versions 1.4.0.1 through 1.6.1.18, consider removing or restricting access to the file upload.php file in the Attribute Wizard addon until a patch is available. For Attribute Wizard addon version 1.6.9, restrict the upload of .phtml files to prevent arbitrary code execution.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2018-10942
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com