Vulnerability CVE-2022-26521

Vulnerability CVE-2022-26521

Published: 2022-03-10

Description:

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

See advisories in our WLB2 database:

	Topic	Author	Date
High	Remote Code Execution in Abantecart-1.3.2	Sarang Tumne	13.11.2022

Type:

CWE-434

(Unrestricted Upload of File with Dangerous Type)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.5/10	6.4/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Abantecart -> Abantecart

References:

https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt

Copyright 2024, cxsecurity.com