CVE-2024-21518: high-severity vulnerability in opencart/opencart
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenCart's marketplace installer has a flaw that lets attackers extract files from malicious archives to any location on the server, potentially overwriting important files or adding malicious code to the website.
A path traversal vulnerability in OpenCart 4.0.0.0+ allows attackers to craft malicious ZIP archives that bypass sanitization checks during extraction via the marketplace installer, enabling arbitrary file creation and overwriting in the web root. The attacker must be able to upload or trigger installation of a malicious marketplace extension. Impact includes code execution through file placement in web-accessible directories.