CVE-2019-8292
MEDIUMOnline Store System v1.0 - Unauthenticated Arbitrary Product Deletion via delete_product.php
Title source: llmDescription
Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion.
References (5)
Core 5
Core References
Exploit, Third Party Advisory x_refsource_misc
http://www.vapidlabs.com/advisory.php?v=210
Product x_refsource_misc
https://www.abcprintf.com/view_download.php?id=17
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/02/1
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/12/23/1
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/12/23/2
Scores
CVSS v3
5.3
EPSS
0.0189
EPSS Percentile
76.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-306
Status
published
Products (1)
online_store_system_project/online_store_system
1.0
Published
Oct 01, 2019
Tracked Since
Feb 18, 2026