PT-2024-26229 · Cubecart · Cubecart
CVE-2024-34832
·
Published
2024-06-03
·
Updated
2024-08-22
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CubeCart versions 6.5.5 and earlier
Description
The issue allows an attacker to execute arbitrary code via a crafted file uploaded to the
g and node parameters. This enables the attacker to potentially access and manipulate sensitive data or system resources.Recommendations
For CubeCart versions 6.5.5 and earlier, consider restricting access to the
g and node parameters until a patch is available. As a temporary workaround, avoid using these parameters in file uploads to minimize the risk of exploitation.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cubecart