Shopware version 3.5 suffers from a remote SQL injection vulnerability.
5a6df1b8bd0a494ca93cc2d947cf380ac0ddc0a03aa982f3f7ca4cdd7b20e18cShopware version 5.5.6 suffers from multiple cross site scripting vulnerabilities.
eb25c1077ef6a645db6b377e7b7a016595162543b874efa6accee2d46294a0eeThis Metasploit module exploits a php object instantiation vulnerability that can lead to remote code execution in Shopware. An authenticated backend user could exploit the vulnerability. The vulnerability exists in the createInstanceFromNamedArguments function, where the code insufficiently performs whitelist check which can be bypassed to trigger an object injection. An attacker can leverage this to deserialize an arbitrary payload and write a webshell to the target system, resulting in remote code execution. Tested on Shopware git branches 5.6, 5.5, 5.4, 5.3.
663b17e7e771b4cd3b76f4e9be53f77eb788f99d74c6047ec270aeb991f94fd8Shopware versions 4.0.1 through 5.3.7 suffer from a cross site request forgery vulnerability. Malicious, third-party websites may abuse this API to list, add or remove products from a user's cart.
0c973cc0b8b396e326136493e77ee67e1e021b531a57d187e3ca1760ce5aca8aShopware versions 5.2.5 and 5.3 suffer from multiple cross site scripting vulnerabilities.
b471a5e256c97126390d22fa59933bf0e16731fcf8c452be780c45afc132dd47Shopware versions prior to 5.1.5 suffer from a remote code execution vulnerability.
8ed34df1b1c5c4feb506c2ffe5618e3c1345315775fedc648d88ef2fcbe643b1
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed