CVE-2024-44314: TastyIgniter Incorrect Access Control Vulnerability in Orders Management
Summary
CVE-2024-44314: TastyIgniter Has an Incorrect Access Control Vulnerability. Affects tastyigniter/tastyigniter versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TastyIgniter is an open-source restaurant management system that allows users to manage orders, menus, and reservations. It provides a user-friendly interface for restaurant owners to streamline their operations. However, version 3.7.6 of TastyIgniter has a critical vulnerability in its Orders Management System, which can lead to unauthorized access and manipulation of order statuses.
Vulnerability Detail
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System. The vulnerability is located in the index_onUpdateStatus() function within Orders.php, which does not properly verify user permissions before allowing them to update order statuses. This flaw can be exploited remotely, enabling unauthorized users to manipulate order statuses, potentially leading to financial losses and operational disruptions.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
composer require tastyigniter/tastyigniter:4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Orders Management System by implementing additional user role checks in your application code until the package is updated. This can be done by modifying the index_onUpdateStatus() function to include permission checks.
Conclusion
The Incorrect Access Control vulnerability in TastyIgniter poses significant risks to users by allowing unauthorized access to order management functionalities. It is crucial to update to version 4.0.0 or later to mitigate these risks. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without needing access to your code.
See every vulnerability recorded for tastyigniter/tastyigniter →
FAQ
CVE-2024-44314 is a vulnerability in TastyIgniter that allows unauthorized users to update order statuses due to incorrect access control.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized manipulation of order statuses, which can lead to financial losses and operational disruptions for businesses relying on TastyIgniter.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level that requires prompt attention.
If immediate updates are not possible, implement additional user role checks to restrict access to the Orders Management System as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for tastyigniter/tastyigniter.
