CVE-2019-5887

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-5887
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5887.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-5887
Published
2019-01-10T14:29:00.243Z
Modified
2026-07-08T20:57:40.085499Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal.

References

Affected packages

Git / github.com/gongfuxiang/shopxo

Affected ranges

Type
GIT
Repo
https://github.com/gongfuxiang/shopxo
Events
Introduced
bfa775339ba67afc023cd4933ffbc7be200fdbd9
Last affected
bfa775339ba67afc023cd4933ffbc7be200fdbd9
Database specific 
{
    "cpe": "cpe:2.3:a:shopxo:shopxo:1.2.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.2.0"
        }
    ]
}

Affected versions

1.*
1.2.0
v1.*
v1.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5887.json"