CVE-2019-9761

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2019-03-14

Last modified

2024-08-04

Weaknesses

CWE-611

Affected products

• Phpshe (Phpshe)

References

• https://gitee.com/koyshe/phpshe/issues/ITC0C