Newbee Mall Project
Monthly
Weak password storage in newbee-mall exposes all user credentials to trivial offline recovery: the application hashes passwords with unsalted MD5 and no computational cost factor, so any attacker who obtains the hash table (via database dump, backup leak, or other compromise) can crack plaintext passwords en masse using rainbow tables or commodity GPU cracking. Publicly available exploit/disclosure material exists (VulnCheck advisory and upstream issue), but there is no public exploit identified as being used in active attacks, and EPSS is very low (0.02%, 3rd percentile). This is an enabling credential-disclosure weakness rather than a directly remotely triggerable RCE, and its real impact is contingent on a prior data exposure.
Administrative account takeover in newbee-mall arises from pre-seeded admin accounts shipped in the database initialization schema with a predictable, publicly known default password. Any deployment that runs the provided schema and leaves the seeded credentials unchanged lets remote unauthenticated attackers log in as administrator and take full control of the storefront and its backend. Publicly available exploit information exists (project issue #119 and a VulnCheck advisory), though EPSS is low (0.13%) and it is not listed in CISA KEV, so no public exploit identified as actively exploited.
A vulnerability was found in newbee-mall 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in newbee-mall 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in newbee-mall 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Weak password storage in newbee-mall exposes all user credentials to trivial offline recovery: the application hashes passwords with unsalted MD5 and no computational cost factor, so any attacker who obtains the hash table (via database dump, backup leak, or other compromise) can crack plaintext passwords en masse using rainbow tables or commodity GPU cracking. Publicly available exploit/disclosure material exists (VulnCheck advisory and upstream issue), but there is no public exploit identified as being used in active attacks, and EPSS is very low (0.02%, 3rd percentile). This is an enabling credential-disclosure weakness rather than a directly remotely triggerable RCE, and its real impact is contingent on a prior data exposure.
Administrative account takeover in newbee-mall arises from pre-seeded admin accounts shipped in the database initialization schema with a predictable, publicly known default password. Any deployment that runs the provided schema and leaves the seeded credentials unchanged lets remote unauthenticated attackers log in as administrator and take full control of the storefront and its backend. Publicly available exploit information exists (project issue #119 and a VulnCheck advisory), though EPSS is low (0.13%) and it is not listed in CISA KEV, so no public exploit identified as actively exploited.
A vulnerability was found in newbee-mall 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in newbee-mall 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in newbee-mall 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.