CVE-2022-26521 File upload in n/a
Authenticated administrators can execute arbitrary code by uploading executable files due to configurable image type restrictions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26521?
CVE-2022-26521 is a high-severity vulnerability in n/a, published on 7 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).
Weakness: CWE-434
Which versions are affected by CVE-2022-26521?
1 open source package ship an affected version, including abantecart. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
abantecart Bitnami | All versions | 1.3.2 |
Products include Abantecart Abantecart.
How do I fix CVE-2022-26521?
Upgrade abantecart to 1.3.2 or later.
Is CVE-2022-26521 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-26521 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as BIT-abantecart-2022-26521, GHSA-6x87-qx9j-65qp.