CVE-2017-17874 Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.
HighCVSS 8.8
EPSS 6.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vanguard project marketplace digital products php | = 1.4.0 | No fix listed |
References
- 43315 exploit third-party-advisory vdb-entry