| शीर्षक | Aridius OpenCart modules ? Deserialization |
|---|
| विवरण | Multiple OpenCart modules named `aridius_XYZ` have a PHP Object Injection
vulnerability as a result of Deserialization of Untrusted Data.
It is unclear which versions of Aridius extensions - if any - include the
vulnerable code as the source code for the "official" versions is not open. It
appears to be common for "unofficial" versions of the extensions to be used.
The vulnerability is exploitable remotely without authentication.
(POP/) Gadget Chains exist in OpenCart (3 and 4) which allow Object Injection
vulnerabilities to be exploited, for example to write arbitrary files or achieve
Remote Code Execution.
Such an attack could result in the compromise of a site. |
|---|
| स्रोत | ⚠️ https://gist.github.com/mcdruid/52383f40d11becb79ce4033cb46546eb |
|---|
| उपयोगकर्ता | mcdruid (UID 79710) |
|---|
| सबमिशन | 19/01/2025 06:01 PM (2 साल पहले) |
|---|
| संयम | 29/01/2025 04:29 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 293998 [Aridius XYZ तक 20240927 पर OpenCart News loadMore अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|