Lucene search
PRIOn knowledge basePRION:CVE-2022-37346HistorySep 27, 2022 - 11:15 p.m.
Design/Logic Flaw
2022-09-2723:15:00
PRIOn knowledge base
www.prio-n.com
1
ec-cube
product image
bulk upload
logic flaw
remote attack
administrative privilege
arbitrary file upload
EC-CUBE plugin ‘Product Image Bulk Upload Plugin’ 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.
| CPE | Name | Operator | Version |
|---|---|---|---|
| product_image_bulk_upload | eq | 4.1.0 | |
| product_image_bulk_upload | eq | 1.0.0 |
Related
cve
cve
CVE-2022-37346
2022-09-27 23:15:14
jvn
jvn
nvd
nvd
CVE-2022-37346
2022-09-27 23:15:14
cvelist
cvelist
CVE-2022-37346
2022-09-27 01:55:15