CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
Explanation of Vulnerability in Simple Terms
The bidorbuy Store Integrator contains a code injection vulnerability that allows high-privileged users to execute arbitrary PHP code on the site. An attacker with administrative or equivalent access can inject malicious code through the application, affecting confidentiality, integrity, and availability across the entire system. All versions up to 2.12.0 are affected.
What an attacker can do
Run arbitrary PHP code on the site with full system access.
Potential impact on your site
A compromised admin account can execute code, modify data, steal information, or disable the site entirely.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent role) in the application.
Key dates
External resources
