Arbitrary File Creation Vulnerability in OpenCart 4.0.0.0

CVE-2024-21519

What is CVE-2024-21519?

The vulnerability in OpenCart arises from an arbitrary file creation issue associated with the database restoration functionality. An attacker, possessing admin privileges, can exploit this flaw by injecting PHP code into the database. This enables the creation of a backup file with a custom filename and extension within the /system/storage/backup directory. Although the design of the application typically keeps the storage path outside the web root to enhance security, this vulnerability could still pose significant risks if the application’s configuration is not adequately managed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References