QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2014-3990

Back to search

CVE-2014-3990

Published: Mar 20, 2018

Modified: Aug 6, 2024

PUBLISHED

Description

The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.

VendorProductVersions

n/a

n/a

affected
n/a

References

68529
vdb-entry
x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now