| タイトル | OpenCart 4.1.0.3 Code Injection (CWE-94) |
|---|
| 説明 | A Server-Side Template Injection (SSTI) vulnerability exists in OpenCart x.x.x.x through the latest commit in the Template Editor functionality (admin/controller/design/template.php). This is a regression of CVE-2024-36694, which identified the same SSTI vulnerability in the Theme Editor (admin/controller/design/theme.php) in OpenCart 4.0.2.3. In response to CVE-2024-36694, the codebase was refactored from theme.php to template.php — the class name changed from Theme to Template, the UI was updated from a form dropdown to a file browser, and file extension validation (.twig only) was added. However, the core vulnerability was never remediated. The save() method in template.php still accepts user-supplied Twig template code via POST input and stores it directly to the database without any sanitization, validation, or Twig sandboxing. When the modified template is rendered on the frontend, the injected code executes server-side. Using the payload {{['id']|filter('system')}}, an authenticated administrator achieves remote code execution as the web server user, including reverse shell access. The root cause remains unchanged across all versions: the Twig filter, map, and reduce filters are unrestricted, allowing execution of arbitrary PHP functions such as system(). No SSTI protection, code validation, or Twig sandbox has been implemented in any version. |
|---|
| ソース | ⚠️ https://drive.google.com/file/d/1_ZCvICLKo8AOovDkKFHwsBxh-ciwbElS/view?usp=drive_link |
|---|
| ユーザー | Schlop (UID 95727) |
|---|
| 送信 | 2026年02月21日 17:12 (8 月 ago) |
|---|
| モデレーション | 2026年03月07日 11:59 (14 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 349659 [OpenCart 4.0.2.3 Incomplete Fix CVE-2024-36694 template.php save 特権昇格] |
|---|
| ポイント | 20 |
|---|