Bagisto vulnerabilities

Bagisto is an open source Laravel eCommerce platform. Prior to version 2.3.10, a stored Cross-Site Scripting (XSS) vulnerability exists in the CMS page editor. Although the platform attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request, allowing arbitrary JavaScript to be stored and executed when the page is viewed or edited.

Bagisto is an open source Laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

Bagisto is an open source Laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter.

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

A basic cross-site scripting (XSS) vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/register, in the Customer-Registration Notification Email component. Manipulation of the first_name/last_name arguments allows remote attack. The exploit has been published and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/account/rma/store, involving enforcement of behavioral workflow. Manipulation of the rma_qty/resolution_type/rma_reason_id arguments allows remote attack. The exploit is now public and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A stored cross-site scripting vulnerability in Bagisto before 2.4.4 allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by injecting a malicious payload into the first or last name field during customer registration. The create.blade.php template renders these fields without the v-pre directive, causing Vue.js to evaluate stored expressions as live code.

This vulnerability in Bagisto is due to improper input validation in the ImageCacheController component. An unauthenticated remote attacker can exploit it by sending crafted path traversal sequences via the filename parameter to access arbitrary files outside the intended directory.

In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g., admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user's browser. This vulnerability is fixed in 2.3.8.

In Bagisto eCommerce platform, product data beginning with a spreadsheet formula character (e.g., =, +, -, @) is accepted and later exported to CSV. When opened in spreadsheet software, the cell is interpreted as a formula, potentially leading to data exfiltration and remote command execution.

Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) because unsanitized user input is processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions evaluated by the backend, potentially leading to Remote Code Execution (RCE). The vulnerability is fixed in 2.3.8.

In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g., admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user's browser. This vulnerability is fixed in 2.3.8.

In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin's browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). An attacker can exploit this vulnerability to inject malicious code into server templates.