CVE-2022-27435
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files including webshells via the product image upload feature in Ecommerce-Website v1.1.0. Attackers can achieve remote code execution by uploading malicious PHP files. Anyone running the vulnerable version of this e-commerce software is affected.
💻 Affected Systems
- Ecommerce-Website
📦 What is this software?
Ecommerce Website by Ecommerce Website Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as a pivot point for internal network attacks.
Likely Case
Webshell upload leading to website defacement, data exfiltration, or cryptocurrency mining.
If Mitigated
File upload attempts blocked with proper validation; no impact beyond failed upload attempts.
🎯 Exploit Status
Exploitation requires admin access; multiple public PoCs demonstrate webshell upload leading to RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Implement file upload validation
allAdd server-side validation to restrict uploaded files to allowed image types only.
Modify /public/admin/index.php to validate file extensions and MIME types
Restrict admin access
allImplement IP whitelisting or VPN requirement for admin interface access.
Add .htaccess rules or web server configuration to restrict /public/admin/
🧯 If You Can't Patch
- Disable the product image upload feature entirely
- Implement WAF rules to block file uploads with executable extensions
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with .php extension via /public/admin/index.php?add_product product image upload.Check Version:
Check software version in configuration files or admin panel.Verify Fix Applied:
Verify that PHP file uploads are rejected and only image files are accepted.📡 Detection & Monitoring
Log Indicators:
- File uploads with non-image extensions to /public/admin/index.php
- POST requests to add_product with unusual file names
Network Indicators:
- HTTP POST requests with file uploads to admin endpoint
- Subsequent requests to uploaded PHP files
SIEM Query:
source="web_logs" AND uri="/public/admin/index.php" AND method="POST" AND (file_extension="php" OR file_extension="phtml")🔗 References
- https://drive.google.com/file/d/1op00zVWSuHO4US_iAkD0aTM-tHqqtrIl/view?usp=sharing
- https://github.com/D4rkP0w4r/Full-Ecommece-Website-Add_Product-Unrestricted-File-Upload-RCE-POC
- https://hackmd.io/SCbv5_iJQd2JL2LRqCQYTA
- https://drive.google.com/file/d/1op00zVWSuHO4US_iAkD0aTM-tHqqtrIl/view?usp=sharing
- https://github.com/D4rkP0w4r/Full-Ecommece-Website-Add_Product-Unrestricted-File-Upload-RCE-POC
- https://hackmd.io/SCbv5_iJQd2JL2LRqCQYTA
