Xshop
Monthly
Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.
Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.