The flaw in detronetdip E-commerce allows an attacker to upload arbitrary files through the /seller/assets/backend/profile/addadhar.php endpoint. Because the application does not validate the file type or enforce proper access control, a malicious actor can place a PHP script or other executable content and execute it on the web server. This represents a classic unrestricted upload problem (CWE‑434) compounded by improper access control (CWE‑284), enabling remote code execution if the attacker can reach the upload interface.

Only detronetdip E-commerce version 1.0.0 is affected, specifically the addadhar.php script within the seller asset management module. No other versions are listed, so the impact is confined to that single code base.

The CVSS score of 6.9 indicates moderate severity, yet the EPSS score of less than 1% suggests that, at the time of measurement, exploitation was unlikely. However, the publicly released exploit code demonstrates that an attacker can achieve code execution once the upload flaw is exercised. Whether authentication is required is not detailed in the description; it is inferred that the endpoint may be accessible to logged‑in sellers or could potentially be reached without credentials, which would increase the attacker's opportunity. The vulnerability is not listed in CISA KEV, but the availability of exploit code means that it could become actionable if a suitable target configuration is found.