Description
An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability (that allows control over the whole web site) via the admin.php/user/add URI because a storekeeper account (which is supposed to have only privileges for commodity management) can add an administrator account.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/liu946/hitshop/issues/1
Scores
CVSS v3
8.8
EPSS
0.0095
EPSS Percentile
56.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (1)
hitshop_project/hitshop
< 2014-07-15
Published
Dec 04, 2018
Tracked Since
Feb 18, 2026