Arbitrary File Upload Vulnerability in Online Ordering System by Zerrr0
CVE-2022-36580

7.2HIGH

Key Information:

Vendor

Online Ordering System Project

Status
Online Ordering System
Vendor
CVE Published:
31 August 2022

What is CVE-2022-36580?

The Online Ordering System version 2.3.2 contains an arbitrary file upload vulnerability located in the component /admin/products/controller.php?action=add. This flaw enables attackers to upload a specially crafted PHP file, potentially leading to arbitrary code execution. By exploiting this vulnerability, unauthorized users may gain control and misuse the system, posing significant risks to data integrity and application security.

References

https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.