Incorrect Access Control in TastyIgniter Orders Management System

CVE-2024-44314

What is CVE-2024-44314?

The TastyIgniter version 3.7.6 is susceptible to an Incorrect Access Control vulnerability within its Orders Management System. This flaw exists in the index_onUpdateStatus() function located in Orders.php, where there is a failure to properly validate user permissions for updating order statuses. This oversight allows unauthorized users to exploit the system remotely, potentially leading to unauthorized alterations in order data. Organizations utilizing this version should take immediate action to secure their systems against potential exploits.

References