CVE-2024-40420: openCart Server-Side Template Injection (SSTI) Vulnerability
Summary
CVE-2024-40420: openCart Server-Side Template Injection (SSTI) vulnerability. Affects opencart/opencart versions < 4.0.2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openCart is an open-source e-commerce platform that allows users to create and manage online stores. It provides various features such as product management, order processing, and payment integration. The vulnerability in question affects openCart version 4.0.2.3. This version of openCart includes a function to edit themes, which is vulnerable to Server-Side Template Injection (SSTI).
Vulnerability Detail
The Server-Side Template Injection (SSTI) vulnerability in openCart allows attackers to execute arbitrary code by injecting a crafted payload through the edit theme function. This can lead to various security risks, including unauthorized access, data manipulation, and remote code execution. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to a patched version of openCart.
Conclusion
The Server-Side Template Injection (SSTI) vulnerability in openCart version 4.0.2.3 allows attackers to execute arbitrary code by injecting a crafted payload. To mitigate the risk, users should update their openCart installation to a version beyond 4.0.2.3, which includes a fix for this vulnerability.
See every vulnerability recorded for opencart/opencart →
FAQ
openCart is an open-source e-commerce platform used for creating and managing online stores.
Server-Side Template Injection (SSTI) is a vulnerability that allows an attacker to inject malicious code into server-side templates, leading to code execution and potential security risks.
This vulnerability in openCart can allow attackers to execute arbitrary code, potentially leading to unauthorized access, data manipulation, and remote code execution.
To fix this vulnerability, it is recommended to update openCart to a version beyond 4.0.2.3, which includes a patch for the Server-Side Template Injection (SSTI) vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating to a patched version of openCart.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
