JVN#30900552: EC-CUBE plugin "Product Image Bulk Upload Plugin" vulnerable to insufficient verification in uploading files

EC-CUBE plugin “Product Image Bulk Upload Plugin”, a plugin that enables to upload image files, provided by EC-CUBE CO.,LTD. contains an insufficient verification vulnerability when uploading files (CWE-20).
Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files.

Impact

One of the attack scenarios and the possible impacts is as follows:
If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to uploads a specially crafted file, an arbitrary script may be executed on the system.

Solution

Update the plugin
Update the plugin to the latest version according to the information provided by the developer.

Products Affected

• EC-CUBE plugin “Product Image Bulk Upload Plugin” 1.0.0
• EC-CUBE plugin “Product Image Bulk Upload Plugin” 4.1.0