PT-2024-38057 · Unknown · Ecommerce-Laravel-Bootstrap

Remhopster · Published 2024-07-24 · Updated 2024-07-26 · CVE-2024-7067

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87

Description A critical issue has been found in the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the one named a02111a674ab49f65018b31da3011b1e396f59b1. As a temporary workaround, consider disabling the getCartProductsIds function until a patch is available. Restrict access to the app/Cart.php file to minimize the risk of exploitation. Avoid using the argument laraCart until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-7067

Affected Products

Ecommerce-Laravel-Bootstrap

References · 11

• 🔥 https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2192470359 · Exploit
• 🔥 https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2206863135 · Exploit
• 🔥 https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18 · Exploit
• https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/commit/a02111a674ab49f65018b31da3011b1e396f59b1 · Patch
• https://osv.dev/vulnerability/CVE-2024-7067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7067 · Security Note
• https://vuldb.com/?submit.378780 · Note
• https://vuldb.com/?id.272348 · Note
• https://t.me/cvedetector/1560 · Telegram Post
• https://vuldb.com/?ctiid.272348 · Note
• https://t.me/cvenotify/87555 · Telegram Post