PT-2025-11609 · Unknown · Tastyigniter

Published 2025-03-18 · Updated 2025-03-18 · CVE-2024-44314

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TastyIgniter version 3.7.6

Description The issue is related to an Incorrect Access Control flaw in the Orders Management System, allowing unauthorized users to update order statuses. This occurs due to a failure in verifying user permissions within the index onUpdateStatus() function in Orders.php, making it possible for exploitation to happen remotely and leading to unauthorized order manipulation.

Recommendations For TastyIgniter version 3.7.6, consider restricting access to the index onUpdateStatus() function in Orders.php until a patch is available to prevent unauthorized order status updates. Additionally, review and implement proper access control measures to ensure only authorized users can modify order statuses.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-44314

GHSA-W5H7-MW56-4V7X

Affected Products

Tastyigniter

References · 8

• https://osv.dev/vulnerability/GHSA-w5h7-mw56-4v7x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44314 · Security Note
• https://github.com/tastyigniter/TastyIgniter · Note
• https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php · Note
• https://medium.com/@cnetsec/cve-2024-44314-incorrect-access-control-in-function-updateorder-fc5f2b1b0467 · Note
• https://t.me/cvetracker/19364 · Telegram Post
• https://twitter.com/CVEnew/status/1902009882640802186 · Twitter Post