CVE-2019-25577

MEDIUM

SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme

Title source: cna
STIX 2.1

Description

SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.

Exploits (1)

exploitdb WORKING POC
by Ihsan Sencan · textwebappsphp
https://www.exploit-db.com/exploits/46190

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-46190
https://www.exploit-db.com/exploits/46190
Product product
Official Product Homepage
https://www.seotoaster.com/shopping-cart/
Third Party Advisory third-party-advisory
VulnCheck Advisory: SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme
https://www.vulncheck.com/advisories/seotoaster-ecommerce-local-file-inclusion-via-backend-theme

Scores

CVSS v3 5.5
EPSS 0.0009
EPSS Percentile 25.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
seotoaster/seotoaster < 3.0.0
Seotoaster/SeoToaster Ecommerce 3.0.0
Published Mar 21, 2026
Tracked Since Mar 21, 2026