CVE-2022-27357

Deeper analysis

Ecommerce-Website v1 is affected by an arbitrary file upload vulnerability that resides in the customer registration handler at /customer_register.php. The flaw, tracked as CVE-2022-27357 and assigned CWE-434, permits an attacker to supply a crafted PHP file that the application stores and subsequently executes, resulting in remote code execution. The issue carries a CVSS 3.1 base score of 9.8, reflecting network-accessible, unauthenticated exploitation with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can submit a malicious PHP payload through the registration form, after which the uploaded file can be invoked directly by the web server to run arbitrary commands. Successful exploitation grants the attacker the ability to execute code under the web-server context, typically leading to full control of the application and underlying host.

Public references consist primarily of proof-of-concept materials, including PacketStorm entries and a detailed GitHub walkthrough that demonstrate the upload and subsequent shell access; no vendor advisory or official patch information appears among the listed sources.

The associated EPSS score rose from a low baseline to a peak of 0.2276 on 2025-01-22 before receding to its current value of 0.0339, indicating that material exploitation interest developed well after the 2022 disclosure.