CVE-2017-17874

High

Published: 27/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Vanguard Marketplace Digital Products PHP version 1.4 allows arbitrary file upload via an 'Add a new product' or 'Add a product preview' action, which can make a .php file accessible under an uploads/ URI.

Risk Assessment

An attacker could upload a malicious PHP file, potentially leading to server compromise and access to sensitive data.

Recommendation

It is recommended to implement restrictions on file types that can be uploaded and to introduce validation mechanisms to prevent the upload of dangerous files.

Other vulnerabilities in Vanguard Marketplace Digital Products PHP 1.4

See all

CVE-2017-17936High
Vanguard Marketplace Digital Products PHP has a CSRF vulnerability that occurs at the /search endpoint.
CVE-2017-17873Critical
Vanguard Marketplace Digital Products PHP version 1.4 is vulnerable to SQL Injection via the PATH_INFO parameter in the /p URI.

Original NVD description (English source)

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.