Vulnerability Details CVE-2022-26521
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.081
EPSS Ranking 91.7%
CVSS Severity
CVSS v3 Score 7.2
CVSS v2 Score 6.5
References
- http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html
- https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt
- http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html
- https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt
Products affected by CVE-2022-26521
-
cpe:2.3:a:abantecart:abantecart:1.2.10
-
cpe:2.3:a:abantecart:abantecart:1.2.11
-
cpe:2.3:a:abantecart:abantecart:1.2.12
-
cpe:2.3:a:abantecart:abantecart:1.2.13
-
cpe:2.3:a:abantecart:abantecart:1.2.14
-
cpe:2.3:a:abantecart:abantecart:1.2.15
-
cpe:2.3:a:abantecart:abantecart:1.2.16
-
cpe:2.3:a:abantecart:abantecart:1.2.8
-
cpe:2.3:a:abantecart:abantecart:1.2.9
-
cpe:2.3:a:abantecart:abantecart:1.3.0
-
cpe:2.3:a:abantecart:abantecart:1.3.1
-
cpe:2.3:a:abantecart:abantecart:1.3.2