CVE-2024-0739 is a high severity flaw in Hecheng Leadshop up to 1.4.20, scored 7.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists Hecheng Leadshop up to 1.4.20 as affected. The record says the install argument in /web/leadshop.php leads to deserialization and that the attack can be launched remotely. The vector needs no privileges. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-502.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Find Leadshop installs and check the version in the admin interface or project files. Anything up to 1.4.20 is in scope. Check whether /web/leadshop.php is reachable from the internet and whether the install step has been removed.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
Deserialization flaws happen when an application rebuilds objects from data it received without checking what the data describes. The record tags CWE-502. The impact metrics in the vector are each rated low, yet the score is high because the attack is reachable over the network with no privileges.
In PHP shops, an installer script left in a public path is a recurring problem. Removing or blocking the install entry point after setup, and keeping the application behind a web application firewall, reduces exposure whether or not a patch exists. Because Leadshop handles customer orders, check the host for unexpected files if it has been public.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Is there a fixed version?
None is confirmed in the sources I could check. Look for a newer Leadshop release and its notes.
Does it need a login?
The vector says no privileges are required.
Sources
Last reviewed: 19 October 2026.
