EUVD-2026-36679
GHSA-mj5p-9vqp-6mww
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint (AV:N, PR:N); low complexity per POC; integrity and confidentiality limited to order-scope data with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote access to ShopXO's Scheduled Task (Crontab) API endpoint in versions up to 6.7.1 allows any network attacker to invoke order-state mutation functions - including OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral - without any credentials or authorization. This authorization bypass (CWE-639) directly threatens e-commerce integrity: attackers can fraudulently mark unpaid orders as successful, prematurely close active orders, or artificially award loyalty points. A public proof-of-concept exploit is available on GitHub, no vendor patch has been released, and the vendor did not respond to responsible disclosure - making this an immediately actionable risk for any internet-exposed ShopXO deployment.
Technical ContextAI
ShopXO is a PHP-based open-source e-commerce platform. The vulnerability is located in app/api/controller/Crontab.php, which exposes an API route intended for internal scheduled-task execution (cron automation) of order lifecycle events. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of flaw where the application makes access-control decisions based on caller-supplied identifiers or parameters without validating the caller's authority to perform the action. In this case, the crontab controller functions - OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral - are order-state mutation operations that should be invocable only by the server's internal cron scheduler, but the API route is exposed externally without an authentication gate or IP restriction. The CPE string (cpe:2.3:a:n/a:shopxo:*:*:*:*:*:*:*:*) covers all versions up to and including 6.7.1.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. The primary remediation is to restrict access to the Crontab API endpoint at the web server or firewall layer: block external access to the route corresponding to app/api/controller/Crontab.php and whitelist only the server's own loopback address (127.0.0.1) or internal scheduler IP, effectively ensuring only the legitimate cron process can invoke these functions. As an additional control, deploying a WAF rule to deny requests matching the Crontab controller path from external sources reduces exposure without application changes. Monitor access logs for unexpected calls to the crontab endpoint routes as an interim detection measure. Operators should also audit recent OrderSuccess and GoodsGiveIntegral invocations for signs of prior abuse. Track https://vuldb.com/vuln/370847 and the ShopXO project for any eventual patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today