CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Injection.This issue affects Small Package Quotes – USPS Edition: from n/a through <= 1.3.9.
Explanation of Vulnerability in Simple Terms
Small Package Quotes – USPS Edition versions up to 1.3.9 contain a deserialization vulnerability that allows high-privileged users to execute arbitrary code on the site. An attacker with admin or equivalent access can craft malicious serialized data to run their own PHP code. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
Run arbitrary code on the site with full server access.
Potential impact on your site
A compromised admin account can lead to complete site takeover, data theft, and malware installation.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the site.
Key dates
External resources
