exploit the possibilities

Shopware Remote Code Execution

Shopware Remote Code Execution
Posted Apr 23, 2016
Authored by David Vieira-Kurz

Shopware versions prior to 5.1.5 suffer from a remote code execution vulnerability.

tags | advisory, remote, code execution
advisories | CVE-2016-3109
MD5 | d6df49623650c8d64af4c5aeafdaffab

Shopware Remote Code Execution

Change Mirror Download
CREDITS
========
This issue has been identified by David Vieira-Kurz of Immobilien Scout GmbH.

CVE
====
CVE-2016-3109

AFFECTED PRODUCT
==================
Shopware < 5.1.5 : https://en.shopware.com/

IMPACT
=======
This issue has been triaged with the highest severity (CRITICAL) by the Shopware maintainer because it allows unauthenticated remote code execution by any attacker! This means that an attacker is able to read ANY files on the target system, create new files with malicious content and run arbitrary code on the target system.

PROOF OF CONCEPT
==================
The script located at "/backend/Login/load/" is prone to remote code execution. A proof of concept has been sent to the maintainer and verified by the maintainer of Shopware.
For the time being we will not provide any exploit code publicly.

HOTFIX
======
https://github.com/shopware/shopware/commit/d73e9031a5b2ab6e918eb86d1e2b2e873cd3558d

TIMELINE
========
05/Apr/2016: issue has been identified
05/Apr/2016: issue has been sent to the maintainer
06/Apr/2016: maintainer has verified the issue
07/Apr/2016: maintainer sent hotfix for review
11/Apr/2016: maintainer released a hotfix (version 5.1.5)
23/Apr/2016: this advisory has been published
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close