PT-2022-20084 · Unknown · Merchandise Online Store

K0Xx11 · Published 2022-05-13 · Updated 2022-05-23 · CVE-2022-30381

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0

Description The issue allows for file deletion via the /vloggers merch/classes/Master.php?f=delete img API endpoint. This endpoint is vulnerable to file deletion attacks, potentially allowing unauthorized access to modify or delete files.

Recommendations For Merchandise Online Store version 1.0, consider restricting access to the /vloggers merch/classes/Master.php API endpoint, specifically the f=delete img parameter, to prevent unauthorized file deletion until a patch is available. As a temporary workaround, disabling the delete functionality in the Master.php file could help mitigate the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-30381

Affected Products

Merchandise Online Store

References · 4

• 🔥 https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/merchandise-online-store/delet-file-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-30381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30381 · Security Note
• https://t.me/cibsecurity/42654 · Telegram Post