Qualiteam X-Cart 5.3.1.9

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:qualiteam:x-cart:5.3.1.9:*:*:*:*:*:*:*

part: a version: 5.3.1.9 update: *

VendorQualiteam (f0a99c56-00e1-5cec-b85d-5c52b8eb2e70)
ProductX Cart (56091d74-4554-5afb-9a8a-efa8fda29861)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-15285 vulnerable 2026-06-08 05:08:58.208844 Details available
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog, upload a .php file with an "Add File Via URL" action, and change the image's Description URL to reference the .php URL in the attachments/ directory.
Published: 2017-10-12T08:00:00.000Z
Updated: 2024-08-05T19:50:16.469Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.