PT-2025-11602 · Unknown · Tastyigniter

Published 2025-03-18 · Updated 2025-03-18 · CVE-2024-44313

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TastyIgniter version 3.7.6

Description The issue is related to an Incorrect Access Control problem in the invoice() function within Orders.php. This allows unauthorized users to access and generate invoices due to missing permission checks.

Recommendations For TastyIgniter version 3.7.6, consider disabling the invoice() function within Orders.php until a patch is available to prevent unauthorized access to invoices. Restrict access to the Orders.php module to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-44313

GHSA-GG2F-R4JH-VPMH

Affected Products

Tastyigniter

References · 8

• 🔥 https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44313 · Security Note
• https://osv.dev/vulnerability/GHSA-gg2f-r4jh-vpmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44313 · Vendor Advisory
• https://github.com/tastyigniter/TastyIgniter · Note
• https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php · Note
• https://t.me/cvetracker/19363 · Telegram Post
• https://twitter.com/CVEnew/status/1902009881659371799 · Twitter Post