CVE-2021-26610

godomall5 remote code execution vulnerability

State: Published
Severity: 7.2 High
Published: Oct 27, 2021
Updated: Aug 3, 2024
Reserved: Feb 3, 2021

Description

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	krcert

Weaknesses

CWE-353 Missing Support for Integrity Check

Affected Products

Product	Versions
godomall5 Std, godomall5 ProNHN COMMERCE	6 through 6Affected 9 through 9Affected

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.