GitHub Advisoryadvisory · Packagist

GHSA-wx3q-f5f2-4q8v OpenCart Path Traversal

HIGH Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-11494
Ecosystem
Packagist
Packages
opencart/opencart
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-04-23

Affected packages

• Packagist opencart/opencart: <= 3.0.2.0 (no fix yet)

Description

The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code'].

Related

Alias · CVE (1)

  • CVE-2018-11494 The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References