CVE-2022-24108
Summary
| CVE | CVE-2022-24108 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-17 16:15:00 UTC |
| Updated | 2022-05-26 22:05:00 UTC |
| Description | The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Skyoftech | So Listing Tabs | 2.2.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| So Listing Tabs - Responsive OpenCart 3.0.x & OpenCart 2.x Module by skyoftech | MISC | codecanyon.net | |
| Full Disclosure: CVE-2022-24108: OpenCart's plugin "So Listing Tabs" <= 2.2.0 Deserialization of Untrusted Data | MISC | seclists.org | |
| Responsive OpenCart 3.0.x & OpenCart 2.x Module - So Listing Tabs | MISC | www.smartaddons.com | |
| OpenCart So Listing Tabs 2.2.0 Unsafe Deserialization ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.