Vulnerability · Published Sep 27, 2022 · Assigned by jpcert

CVE-2022-37346

Critical 9.8

In plain English

A critical-severity unrestricted file upload in Product Image Bulk Upload Plugin from EC-CUBE CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 32.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Affected products (as reported)

Vendor	Product	Versions
EC-CUBE CO.,LTD.	Product Image Bulk Upload Plugin	1.0.0 and 4.1.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.ec-cube.net/info/weakness/20220909/product_images_uploader.php x_refsource_MISC
https://jvn.jp/en/jp/JVN30900552/index.html x_refsource_MISC