Skip to main content
Back to Research blog

Advisory: Dynamicweb Logic Flaw Leading to RCE (CVE-2022-25369)

Get research alerts

Share on social

February 20, 2022

Lorem ipsum

Table of Contents

TOC Element

Summary

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again.

Impact

Once an attacker is authenticated as the new admin user they have added, it is possible to upload a web shell and achieve command execution.

Version Tested Against

DynamicWeb 9.12.6

Product Description

Dynamicweb offers a cloud based eCommerce suite. Dynamicweb enables customers to deliver better digital customer experiences and to scale ecommerce success through our Content Management, Digital Marketing, Ecommerce, and Product Information Management solutions.

Solution

Hotfixed versions that contain a fix can be found below:

  • Dynamicweb 9.5.9
  • Dynamicweb 9.6.16
  • Dynamicweb 9.7.8
  • Dynamicweb 9.8.11
  • Dynamicweb 9.9.
  • Dynamicweb 9.10.18
  • Dynamicweb 9.12.8
  • Dynamicweb 9.13.0+

Vulnerabilities

https://target.com/Admin/Access/Setup/Default.aspx?Action=createadministrator&adminusername=admin1&adminpassword=admin1&adminemail=test@test.com&adminname=test

Blog Post

The blog post detailing the steps taken for the discovery of this vulnerability can be found here.

Credits

Assetnote Security Research Team

Timeline

The timeline for this disclosure process can be found below:

  • Jan 21st, 2022: Disclosure of pre-auth bug to add admin user
  • Jan 21st, 2022: Confirmation and fix information from Dynamicweb CTO
  • Jan 24th, 2022: Fixes rolled out to Dynamicweb customers
  • Feb 24th, 2022: Published advisory and blog post
Shubham Shah

Author

Shubham Shah

Chief Security Research Officer at Searchlight Cyber

Connect

Shubham Shah is Chief Security Research Officer, having joined Searchlight Cyber following the acquisition of Assetnote, where he was Co-Founder and CTO. Shubham leads the global security research team whose findings feed directly into Searchlight Exposure – surfacing zero-day vulnerabilities in the tools organisations rely on, often months ahead of public disclosure. He remains a prolific bug bounty hunter ranked in the top 50 hackers on HackerOne, and has presented at various industry events including QCon London, Kiwicon, AusCert, BSides Canberra, and CrikeyCon.

Explore related Content

Research

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

July 20, 2026

Research

wp2shell: Pre Authentication RCE in WordPress Core

July 17, 2026

Research

Smashing the ServiceNow Sandbox – Pre Authentication RCE

July 14, 2026

Research

CargoWise WebTracker – The Keys Were in the Cargo

June 25, 2026

Research

Two Bypasses for Chrome's Sanitizer API

May 22, 2026

Research

Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082)

May 21, 2026

View all