title: godomall5 remote code execution vulnerability
description: The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
problem types: CWE-353 Missing Support for Integrity Check
affected:
{
platforms: Windows
product: godomall5 Std, godomall5 Pro
vendor: NHN COMMERCE
versions:
lessThanOrEqual: 6, status: affected, version: 6 , versionType: custom
lessThanOrEqual: 9, status: affected, version: 9, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]