Description

The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code'].

Remediation

References

CVE-2018-11494

Related Vulnerabilities

WordPress Plugin Rise Blocks-A Complete Gutenberg Page Builder Unspecified Vulnerability (1.0.0)

WordPress Plugin Welcart e-Commerce Multiple Vulnerabilities (1.4.17)

WordPress Plugin Easy Digital Downloads-htaccess Editor Cross-Site Scripting (1.0.0)

MySQL CVE-2021-2010 Vulnerability (CVE-2021-2010)

Oracle JRE CVE-2013-5778 Vulnerability (CVE-2013-5778)

Severity

High

Classification

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2018-11494