CVE-2019-9761

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.71% chance of exploitation in the next 30 days, 76th percentile

Published

2019-03-14

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://gitee.com/koyshe/phpshe/issues/ITC0C

References

• CVE Record
• NVD entry

Related

• CVE-2019-9760
• CVE-2019-9762
• CVE-2019-9758
• CVE-2019-9766
• CVE-2019-9757
• CVE-2019-9767