GHSA-pgj4-g5j4-cmfx
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
Summary
# Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. # Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by utilizing the unserialize function when processing data from a GET request. This flaw, present in the app/code/community/Ophirah/Qquoteadv/controllers/DownloadController.php and app/code/community/Ophirah/Qquoteadv/Helper/Data.php files, poses a significant risk of Remote Code Execution, especially when custom file options are employed on a product. Attackers exploiting this vulnerability could execute arbitrary code remotely, leading to unauthorized access and potential compromise of sensitive data.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Packagist | cart2quote/module-quotation | — | 4.4.6, 5.4.4 |
| Packagist | cart2quote/module-quotation-encoded | — | 5.4.4 |
Remediation: Upgrade to 4.4.6 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.