CVE-2018-14570 - CVE House
Back to Database
Status published High CVE-2018-14570

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business...

Vulnerability Description

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14570

Credits & Attribution

No credits recorded in the NVD database.

References

More from niushop

View All →
CVE-2020-19672
Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator...
Critical 9.8
CVE-2020-19670
In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be...
Medium 4.9
CVE-2019-16311
NIUSHOP V1.11 has CSRF via search_info to index.php....
High 8.8
CVE-2019-16310
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI....
Medium 5.4

Affected Vendor

Affected Software

b2b2c multi-business
Vulnerable Versions:
1.11

Timeline

Official Publish: July 23rd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.