CVE-2025-5108 | zongzhige ShopXO 6.5.0 ZIP File Payment.php Upload params unrestricted upload

A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload.

The identification of this vulnerability is CVE-2025-5108. The attack may be initiated remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.