Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a r

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jpcert

Description

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

EC-CUBE CO.,LTD. Product Image Bulk Upload Plugin

  • 1.0.0 and 4.1.0affected

References