OpenCart 'Cart::getProducts()' Method PHP Object Injection Vulnerability

Bugtraq ID:	68529
Class:	Input Validation Error
CVE:	CVE-2014-3990
Remote:	Yes
Local:	No
Published:	Jul 14 2014 12:00AM
Updated:	Jul 14 2014 12:00AM
Credit:	Egidio Romano
Vulnerable:	OpenCart OpenCart 1.4.9 OpenCart OpenCart 1.3.2 OpenCart OpenCart 1.1.9 OpenCart OpenCart 1.1.8 OpenCart OpenCart 1.5.2.1 OpenCart OpenCart 1.5.1.2 OpenCart OpenCart 1.5.1.1 OpenCart OpenCart 1.4.9.1
Not Vulnerable:

OpenCart 'Cart::getProducts()' Method PHP Object Injection Vulnerability

OpenCart is prone to a remote PHP object-injection vulnerability.

Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.

OpenCart 1.5.6.4 is vulnerable; other versions may also be affected.

OpenCart 'Cart::getProducts()' Method PHP Object Injection Vulnerability

An attacker can exploit this issue using a web browser.

OpenCart 'Cart::getProducts()' Method PHP Object Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

OpenCart 'Cart::getProducts()' Method PHP Object Injection Vulnerability

References:

• OpenCart Homepage (OpenCart)