E-commerce V 1.0 | customer image - /customer_register.php | Remote Code Execution| Found By Maloy Roy Orko
Hi All, I am Maloy Roy Orko . CVE Number: CVE-2025-2035 Recently in one of my pentest research, I found an Ecommerce-Website-using-PHP, Bootstrap4, Html5, Css3 By SHAHID AFRIDI ZIHAD which is an open source E-commerce application using native PHP. Curious to explore its functionalities, I downloaded and set it up in my local system. After fiddling with the source code, I found that it did not have any kind of File Extension or Upload protection In signup.php file. It can lead into : Malware Distribution Remote Code Execution (RCE) Data Breach Denial of Service (DoS) Web Shell Installation Bypassing Security Controls Reputation Damage The Main Thing Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this . Title of the Vulnerability: E-commerce V 1.0 | customer image - /customer_register.php | Remote Code Executio...