| 제목 | OpenCart 4.1.0.3 Code Injection (CWE-94) |
|---|
| 설명 | A Server-Side Template Injection (SSTI) vulnerability exists in OpenCart x.x.x.x through the latest commit in the Template Editor functionality (admin/controller/design/template.php). This is a regression of CVE-2024-36694, which identified the same SSTI vulnerability in the Theme Editor (admin/controller/design/theme.php) in OpenCart 4.0.2.3. In response to CVE-2024-36694, the codebase was refactored from theme.php to template.php — the class name changed from Theme to Template, the UI was updated from a form dropdown to a file browser, and file extension validation (.twig only) was added. However, the core vulnerability was never remediated. The save() method in template.php still accepts user-supplied Twig template code via POST input and stores it directly to the database without any sanitization, validation, or Twig sandboxing. When the modified template is rendered on the frontend, the injected code executes server-side. Using the payload {{['id']|filter('system')}}, an authenticated administrator achieves remote code execution as the web server user, including reverse shell access. The root cause remains unchanged across all versions: the Twig filter, map, and reduce filters are unrestricted, allowing execution of arbitrary PHP functions such as system(). No SSTI protection, code validation, or Twig sandbox has been implemented in any version. |
|---|
| 원천 | ⚠️ https://drive.google.com/file/d/1_ZCvICLKo8AOovDkKFHwsBxh-ciwbElS/view?usp=drive_link |
|---|
| 사용자 | Schlop (UID 95727) |
|---|
| 제출 | 2026. 02. 21. PM 05:12 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 03. 07. AM 11:59 (14 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 349659 [OpenCart 4.0.2.3 Incomplete Fix CVE-2024-36694 template.php save 권한 상승] |
|---|
| 포인트들 | 20 |
|---|