{"vulnerability": "CVE-2017-18357", "sightings": [{"uuid": "27ebae9b-02f0-4355-bb3c-8e238c30f879", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "exploited", "source": "https://www.exploit-db.com/exploits/46915", "content": "", "creation_timestamp": "2019-05-23T00:00:00.000000Z"}, {"uuid": "f443d877-c732-43e6-be1f-876b17ad08a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "7d100ce3-b057-424d-ad8a-ef5a9eb7da18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:56.000000Z"}, {"uuid": "f7fa4a8f-69c3-44a5-bf6f-7a080356dca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shopware_createinstancefromnamedarguments_rce.rb", "content": "", "creation_timestamp": "2019-05-17T23:32:16.000000Z"}, {"uuid": "d9aff140-d9b2-4b8d-9cca-233d6343a2d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "seen", "source": "https://t.me/cibsecurity/2037", "content": "ATENTION\u203c New - CVE-2017-18357\n\nShopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-01-15T18:57:32.000000Z"}, {"uuid": "a3765dc1-7367-4265-b96b-e0e14d356546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-18357", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shopware_createinstancefromnamedarguments_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Karim Ouerghemmi\", \"mr_me \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a php object instantiation vulnerability that can lead to RCE in\\n          Shopware. An authenticated backend user could exploit the vulnerability.\\n\\n          The vulnerability exists in the createInstanceFromNamedArguments function, where the code\\n          insufficiently performs whitelist check which can be bypassed to trigger an object injection.\\n\\n          An attacker can leverage this to deserialize an arbitrary payload and write a webshell to\\n          the target system, resulting in remote code execution.\\n\\n          Tested on Shopware git branches 5.6, 5.5, 5.4, 5.3.\", \"disclosure_date\": \"2019-05-09\", \"fullname\": \"exploit/multi/http/shopware_createinstancefromnamedarguments_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/shopware_createinstancefromnamedarguments_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/shopware_createinstancefromnamedarguments_rce\", \"references\": [\"CVE-2019-12799\", \"CVE-2017-18357\", \"URL-https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:11.544018Z"}]}