CVE-2024-22724

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22724
An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/osCommerce/osCommerce-V4/issues/62 Exploit Issue Tracking Third Party Advisory
https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c Exploit Third Party Advisory
https://github.com/osCommerce/osCommerce-V4/issues/62 Exploit Issue Tracking Third Party Advisory
https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oscommerce:oscommerce:4.0:*:*:*:*:*:*:*
History

27 Jun 2025, 15:21

Type Values Removed Values Added
First Time Oscommerce
Oscommerce oscommerce
References () https://github.com/osCommerce/osCommerce-V4/issues/62 - () https://github.com/osCommerce/osCommerce-V4/issues/62 - Exploit, Issue Tracking, Third Party Advisory
References () https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c - () https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c - Exploit, Third Party Advisory
CPE cpe:2.3:a:oscommerce:oscommerce:4.0:*:*:*:*:*:*:*

21 Nov 2024, 08:56

Type Values Removed Values Added
References () https://github.com/osCommerce/osCommerce-V4/issues/62 - () https://github.com/osCommerce/osCommerce-V4/issues/62 -
References () https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c - () https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c -

06 Aug 2024, 15:35

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en osCommerce v4 que permite a atacantes locales eludir las restricciones de carga de archivos y ejecutar código arbitrario a través de la función de carga de fotos de perfil del administrador.
CWE CWE-94
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.6

21 Mar 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-21 04:15

Updated : 2025-06-27 15:21

NVD link : CVE-2024-22724

Mitre link : CVE-2024-22724

CVE.ORG link : CVE-2024-22724

JSON object : View

Products Affected

oscommerce

  • oscommerce
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')