Merchandise Online Store CVE-2022-42238

HIGH

Direct Request ('Forced Browsing') (CWE-425)

2022-10-11 cve@mitre.org

Privilege Escalation Merchandise Online Store

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 11, 2022 - 18:15 nvd

HIGH 8.8

DescriptionNVD

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.

AnalysisAI

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-425. A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard. Affected products include: Merchandise Online Store Project Merchandise Online Store.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Merchandise Online Store

View all

CVE-2022-42237 CRITICAL Act Now POC

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account. Rated critica

CVE-2022-30423 CRITICAL Act Now POC

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile uploa

CVE-2022-30454 CRITICAL Act Now POC

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product. Rat

CVE-2022-30395 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart. Rated

CVE-2022-30392 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_categor

CVE-2022-30391 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category. R

CVE-2022-30386 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured. R

CVE-2022-30385 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order. Rate

CVE-2022-30384 CRITICAL Act Now POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.

CVE-2022-30403 HIGH This Week POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=products&c=. Rated high severity (CV

CVE-2022-30402 HIGH This Week POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_cate

CVE-2022-30401 HIGH This Week POC

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=. Rated high severit

Same weakness CWE-425 – Direct Request ('Forced Browsing')

View all

CVE-2017-14244 CRITICAL POC

CVE-2024-0204 CRITICAL POC

CVE-2017-15235 HIGH POC

CVE-2024-24592 CRITICAL POC

CVE-2022-45276 CRITICAL POC

CVE-2022-26279 CRITICAL POC

CVE-2021-36560 CRITICAL POC

CVE-2020-24660 CRITICAL POC

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2022-42238 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy