A critical remote code execution vulnerability exists in detronetdip E-commerce version 1.0.0 due to improper file validation, which is currently being targeted by public proof-of-concept exploits.

The application fails to perform server-side validation of file uploads at the seller profile endpoint, specifically in the file seller/assets/backend/profile/addadhar.php. An unauthenticated attacker can bypass weak MIME-type checks by manipulating the Content-Type header and the file extension, allowing the upload and execution of malicious PHP scripts.

Successful exploitation grants an attacker the ability to execute arbitrary commands on the underlying web server with the privileges of the web service account. This leads to full system compromise, potential data exfiltration from the database, and the ability to maintain persistence within the network. Given the CVSS score of 7.3, this flaw presents a high risk to business continuity and data integrity.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected PHP files within the seller/assets/backend/profile/ directory or disable the file upload functionality entirely until a fix is released.

Proactive Monitoring: Monitor server logs for suspicious HTTP POST requests directed at the /seller/assets/backend/profile/ directory and check for the existence of unknown or newly created .php files within the /media/seller_profile/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block file upload attempts that contain non-image extensions or suspicious content-type headers, and ensure the web server is configured to deny direct execution of scripts within the upload media directory.

Public Exploit Available: Yes, a public proof-of-concept exploit exists, as documented in the linked research writeup on GitHub.

Given the availability of public exploit code and the critical nature of remote code execution, organizations using detronetdip E-commerce should treat this as a high-priority incident. Until the vendor provides a secure update, immediate manual mitigation steps are required to prevent unauthorized system access.