CVE-2022-41504 - An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file

Back Back to CVE browser

HIGH

An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file

Published Oct 18, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.15%

Description

An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44697
Advisory
https://github.com/cx852/bug_report/blob/main/vendors/mayuri_k/billing-system-project/RCE-1.md
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44697		Advisory
https://github.com/cx852/bug_report/blob/main/vendors/mayuri_k/billing-system-project/RCE-1.md		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 18, 2022

Updated May 15, 2025

Reserved Sep 26, 2022

Link CVE-2022-41504

CISA Vulnrichment

Updated May 15, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-41504

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 18, 2022

Updated May 15, 2025

Link EUVD-2022-44697

GitHub

No data