What is CVE-2019-5886?

CVE-2019-5886 is a critical-severity vulnerability in Shopxo, classified under Improper Locking. CVSS score: 9.8/10. Published 2019-01-10.

How severe is CVE-2019-5886?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Shopxo

CVE-2019-5886

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to…

EPSS: 0.010 (58.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Shopxo — versions 1.2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-667 — Improper Locking
CWE-862 — Missing Authorization

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-5886?: CVE-2019-5886 is a critical-severity vulnerability in Shopxo, classified under Improper Locking. CVSS score: 9.8/10. Published 2019-01-10.
How severe is CVE-2019-5886?: Critical severity. CVSS v3 base score is 9.8 out of 10.