CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.
Explanation of Vulnerability in Simple Terms
The eCommerce Product Catalog contains a deserialization vulnerability in versions up to 3.4.3. An authenticated administrator can supply malicious serialized data that the application deserializes without validation, allowing them to execute arbitrary PHP code on the server. This requires high-level administrative access but grants complete control over the site.
What an attacker can do
Run arbitrary PHP code on the server with the privileges of the web application.
Potential impact on your site
An admin account compromise or malicious admin can fully compromise your site, steal data, or inject malware.
Conditions required to exploit
Attacker must have administrator-level access to the application.
Key dates
External resources
Related vulnerabilities
