CVE-2021-27817

Name of the Vulnerable Software and Affected Versions: shopxo version 1.9.3

Description: A remote command execution issue allows an attacker to upload malicious code generated by phar where the suffix is JPG. This is achieved by modifying the phar suffix, enabling the upload of malicious code.

Recommendations: For shopxo version 1.9.3, consider restricting the upload of files with modified suffixes to prevent exploitation until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.