提交 #845908: kirilkirkov Ecommerce-CodeIgniter-Bootstrap master Deserialization

## Description
Ecommerce-CodeIgniter-Bootstrap contains an unsafe deserialization vulnerability in shopping cart cookie handling. The application reads the attacker-controlled `shopping_cart` cookie and passes it directly to PHP `unserialize()` without validating the serialized type or enforcing an expected safe structure.
An unauthenticated attacker can supply crafted serialized data that breaks the shopping cart flow and triggers an application-level denial of service. In the verified environment, the crafted cookie caused an HTTP 500 response and verbose error output that disclosed internal paths and implementation details.

## Technical Details
- Affected component: `application/libraries/ShoppingCart.php`
- Vulnerable function: `getCartItems()`
- Vulnerable sink: `unserialize(get_cookie('shopping_cart'))`
- Trigger path: `/index.php/shopping-cart`
- Weakness: `CWE-502`
- CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H`
- Severity: `High`
- Published: `2026-05-20`
- Patched version / fix commit: `49b20f53de2b7ec34e920b11c863f1491d911a04`
- GitHub Security Advisory: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-9g5q-g6m3-v5cr
- Vendor fix: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/49b20f53de2b7ec34e920b11c863f1491d911a04

• 来源: ⚠️ https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-9g5q-g6m3-v5cr
• 用户: Anonymous User
• 提交: 2026-06-02 10時14分 (1 月前)
• 管理: 2026-07-03 19時25分 (1 month later)
• 状态: 已接受
• VulDB条目: 376152 [kirilkirkov Ecommerce-CodeIgniter-Bootstrap 直到 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7 ShoppingCart.php getCartItems shopping_cart 权限提升]
• 积分: 20