Vulnerability identifier: #VU15488

Vulnerability risk: Critical

CVSSv3.1: 9.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:T/RC:C]

CVE-ID: N/A

CWE-ID: CWE-94

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TBT Rewards
Client/Desktop applications / Other client software

Vendor: swissuplabs

Description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The weakness exists due to PHP code injection. A remote attacker can send a specially crafted Zend_Log object and abuse PHP’s unserialize() function to inject and execute own PHP code and modify the database or any Javascript files.

Note: the vulnerability has been actively exploited by Magecart group to steal payment card data.

Mitigation
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Vulnerable software versions

TBT Rewards: All versions

---

External links
http://gwillem.gitlab.io/2018/10/23/magecart-extension-0days/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.