CVE-2021-26610
27.10.2021, 01:15
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.Enginsight
| Vendor | Product | Version |
|---|---|---|
| nhn-commerce | godomall5 | 𝑥 ≤ 6 |
| nhn-commerce | godomall5 | 𝑥 ≤ 9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-353 - Missing Support for Integrity CheckThe software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.