CVE-2020-26008

Name of the Vulnerable Software and Affected Versions ShopXO version 1.9.0

Description The issue concerns an arbitrary file upload vulnerability in the PluginsUpload function, located in application/service/PluginsAdminService.php. This vulnerability allows attackers to execute arbitrary code by uploading a crafted PHP file.

Recommendations For ShopXO version 1.9.0, consider disabling the PluginsUpload function in application/service/PluginsAdminService.php until a patch is available to prevent arbitrary file uploads. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.