Description
SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Seotoaster | SeoToaster Ecommerce | 3.0.0 | — |
References
- ExploitDB-46190 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme third-party-advisory