Description
protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit
Scores
CVSS v3
7.5
EPSS
0.0089
EPSS Percentile
55.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
Status
published
Products (1)
yxcms/yxcms
1.4.7
Published
Mar 19, 2018
Tracked Since
Feb 18, 2026