Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 20/03/2018 Updated: 25/04/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and previous versions allows remote malicious users to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opencart opencart

OpenCart versions 1564 and below suffer from a PHP objection injection vulnerability ...

CWE-611 CWE-918 https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076f http://www.securityfocus.com/bid/68529 http://seclists.org/fulldisclosure/2014/Jul/67 http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.html http://karmainsecurity.com/KIS-2014-08 http://www.securityfocus.com/archive/1/532763/100/0/threaded https://nvd.nist.gov https://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-3990

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect