Skip to main content

Merchandise Online Store CVE-2022-30423

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2022-06-02 cve@mitre.org
RCE File Upload Merchandise Online Store
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 02, 2022 - 14:15 nvd
CRITICAL 9.8

DescriptionNVD

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information.

AnalysisAI

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information. Affected products include: Merchandise Online Store Project Merchandise Online Store.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Merchandise Online Store

View all
CVE-2022-42237 CRITICAL POC
9.8 Oct 17

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account. Rated critica
CVE-2022-30454 CRITICAL POC
9.8 May 24

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product. Rat
CVE-2022-30395 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart. Rated
CVE-2022-30392 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_categor
CVE-2022-30391 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category. R
CVE-2022-30386 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured. R
CVE-2022-30385 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order. Rate
CVE-2022-30384 CRITICAL POC
9.8 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.

CVE-2022-42238 HIGH POC
8.8 Oct 11

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin da
CVE-2022-30403 HIGH POC
7.2 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=products&c=. Rated high severity (CV
CVE-2022-30402 HIGH POC
7.2 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_cate
CVE-2022-30401 HIGH POC
7.2 May 13

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=. Rated high severit

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-30423 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy