CVE-2018-0658

Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier

Description The issue allows an attacker with administrative rights to execute arbitrary PHP code on the server. This can be achieved via unspecified vectors, indicating a potential input validation problem.

Recommendations For EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17. For GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17.