by Kastro
Paper/Archive/CVE-2022-24108

CVE-2022-24108

mitre — The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parame…

EPSS 33%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.3.983 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsmartaddons.com/opencart-extensions/so-listing-tabs-responsive-opencart-30x-opencart-2x-modulerefcodecanyon.net/item/so-listing-tabs-responsive-opencart-module/12388133refseclists.org/fulldisclosure/2022/May/30refpacketstormsecurity.com/files/167197/OpenCart-So-Listing-Tabs-2.2.0-Unsafe-Deserialization.html