CVE-2022-36580: Malicious File Upload
Published Aug 31, 2022
·Updated
An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file.
Affected Software
1 affected component
Online Ordering System Project Online Ordering System=2.3.2
Event History
Aug 31, 2022
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-36580?
CVE-2022-36580 is considered a critical vulnerability due to the potential for arbitrary code execution.
2
How do I fix CVE-2022-36580?
To fix CVE-2022-36580, ensure that file upload functionality restricts file types to only allow safe extensions and implement proper file validation.
3
What systems are affected by CVE-2022-36580?
CVE-2022-36580 affects Online Ordering System version 2.3.2.
4
What can an attacker do with CVE-2022-36580?
An attacker can exploit CVE-2022-36580 to upload and execute arbitrary PHP code on the server.
5
Is there a patch available for CVE-2022-36580?
As of now, there is no official patch released for CVE-2022-36580, so mitigate the risk by implementing security best practices for file uploads.