OpenCart 3/4.x Injection CVE-2024-38191 Advisory & POC

Vulnerability Overview Vulnerability Name: Security Advisory – CVE-2024-38191: Injection via deleted DELETE-based API – family of 7 pages Vulnerability Type: Injection Affected Products: - Affected Products: - Product: OpenCart - Version: 3.x.x - Status: Fixed - Date: 2024-06-06 - Affected Products: - Product: OpenCart - Version: 4.x.x - Status: Fixed - Date: 2024-06-06 Vulnerability Description: This vulnerability allows attackers to perform injection attacks via a deleted DELETE-based API, affecting 7 pages. Scope of Impact Affected Versions: - OpenCart 3.x.x - OpenCart 4.x.x Fixed Versions: - OpenCart 3.x.x (2024-06-06) - OpenCart 4.x.x (2024-06-06) Remediation Fix Method: Upgrade to the latest version (released on 2024-06-06). Recommended Actions: - Immediately update OpenCart to the latest version. - Inspect and remediate affected API endpoints. - Implement input validation and output encoding to prevent injection attacks. POC Code or Exploit Code Other Key Information Vulnerability Discoverer: Not explicitly mentioned Report Date: 2024-06-06 Fix Date: 2024-06-06 Impact: May lead to data leakage, data tampering, or system crashes Exploitation Difficulty: Medium (requires specific conditions and privileges) Summary This vulnerability affects OpenCart versions 3.x.x and 4.x.x, allowing attackers to perform injection via a deleted DELETE-based API. It is recommended to immediately update to the latest version and implement input validation and output encoding to prevent injection attacks. The provided POC code demonstrates a potential exploitation method, though actual exploitation requires more specific details.

Goal Reached Thanks to every supporter — we hit 100%!

OpenCart 3/4.x Injection CVE-2024-38191 Advisory & POC

More from this source