MStore API, 679d7241-a136-4eb3-a9ec-42de2492ddfc
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api] < 3.4.5 MStore API < 3.4.5 - Unauthenticated PHP File Upload The api/flutter_woo/config_file REST endpoint of the plugin, does not have proper authorisation in place (only checking if the plugin has a license), nor enough validation against the config file sent in the request. As a result, unauthenticated users could use such endpoint to upload a PHP file, leading to RCE We confirmed that the issue is still present in the latest version (currently 3.4.4). The vendor has been notified on October 5th, 2021
- Affected versions
-
max 3.4.5.
- Status
-
vulnerable