An unauthenticated vulnerability in ShopXO allows remote attackers to bypass authorization mechanisms by manipulating scheduled tasks in the Crontab controller.

This vulnerability stems from improper access control in the Crontab.php controller, which allows an unauthenticated remote attacker to trigger or manipulate scheduled tasks. By bypassing existing authorization checks, an attacker can potentially execute unauthorized actions.

The CVSS score of 7.3 (High) highlights the significant risk of unauthorized access and potential system compromise. If exploited, an attacker could gain control over administrative tasks, leading to data tampering, unauthorized site modifications, or complete system takeover.

Immediate Action: Upgrade to the latest version of ShopXO that includes the security patch for Crontab.php authorization vulnerabilities.

Proactive Monitoring: Review web server logs for suspicious requests directed at the Crontab.php controller or unexpected execution of administrative scheduled tasks.

Compensating Controls: Restrict access to administrative controllers and cron-related endpoints using IP whitelisting or by requiring authentication at the web server (e.g., Nginx/Apache) level.

Public Exploit Available: true

This vulnerability is highly critical due to the availability of a public exploit and the lack of required authentication. Organizations running ShopXO should treat this as a high-priority remediation task and apply necessary updates immediately to secure their platform from unauthorized access.