CVE-2022-24108

Katalog CVE

CVSS 9.8 · Critical EPSS 32,6%

Kerentanan Deserialization of Untrusted Data pada skyoftech so listing tabs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.

Rincian

Terbit di NVD

17 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

32,6% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/167197/OpenCart-So-Listing-Tabs-2.2.0-Unsafe-Deserialization.html exploit · advisory pihak ketiga · vdb entry
• https://codecanyon.net/item/so-listing-tabs-responsive-opencart-module/12388133 product · advisory pihak ketiga
• https://seclists.org/fulldisclosure/2022/May/30 exploit · mailing list · advisory pihak ketiga
• https://www.smartaddons.com/opencart-extensions/so-listing-tabs-responsive-opencart-30x-opencart-2x-module product · advisory pihak ketiga