Опубликовано: 02 янв. 2026
Источник: github
Github: Прошло ревью
CVSS4: 8.9
CVSS3: 9.8
Описание
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Summary
SSTI when normal customer orders any product in add address step can inject value run in admin view.
Details
As normal user
- Go to
http://127.0.0.1:8000/ - Add order to cart and continue to checkout
- In step of add address inject this value {{7*7}} in any input
As admin
- Go to
http://127.0.0.1:8000/admin/sales/orders - And notice the vlaue appear in admin view 49
As normal user
3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49
PoC
- Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d
Impact
- Can lead to RCE
Пакеты
Наименование
bagisto/bagisto
composer
Затронутые версииВерсия исправления
< 2.3.10
2.3.10
Связанные уязвимости
CVSS3: 9.8
nvd
около 1 месяца назад
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.