CVE-2022-37346

published 2022-09-27

CVE-2022-37346: EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ec-cube	product_image_bulk_upload	—	—
ec-cube	product_image_bulk_upload	—	—
ec-cube_co_ltd	product_image_bulk_upload_plugin	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434