CVE-2018-0658 Code injection in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
Administrative users can execute arbitrary PHP code on the server due to input validation flaws in EC-CUBE payment modules.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0658?
CVE-2018-0658 is a high-severity code injection vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE, published on 7 Sep 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
Weakness: CWE-20
Which versions are affected by CVE-2018-0658?
It affects 2 products.
Products include Ec-Cube Ec-Cube Payment Module, Gmo-Pg Gmo-Pg Payment Module.
How do I fix CVE-2018-0658?
No fix has been published for CVE-2018-0658 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-0658 being exploited?
There is no known exploitation of CVE-2018-0658 in the wild and no public exploit code.
Other vulnerabilities in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
Sources
Also known as GHSA-rjmh-9927-cj3q.