CVE-2017-11675: Code Injection

Published Jul 27, 2017

Updated

The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to admindir/login.php, if there is an export of an error-log entry for that invalid array index.

Affected Software

1 affected component

Zen-cart Zen Cart=1.5.5e

Event History

Jul 27, 2017

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-11675?

CVE-2017-11675 is classified as a critical vulnerability due to its potential to allow remote authenticated users to execute arbitrary PHP code.

How do I fix CVE-2017-11675?

To fix CVE-2017-11675, ensure you upgrade Zen Cart to a patched version beyond 1.5.5e.

Who is affected by CVE-2017-11675?

CVE-2017-11675 affects users of Zen Cart version 1.5.5e who have administrative privileges.

What are the potential impacts of exploiting CVE-2017-11675?

Exploiting CVE-2017-11675 allows an attacker to execute malicious PHP code on the server, leading to full system compromise.

Is CVE-2017-11675 easy to exploit?

CVE-2017-11675 is considered relatively easy to exploit for remote authenticated users with knowledge of array index manipulation.