Kurz gesagt
- CVE-2026-21448 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in bagisto/bagisto, bagisto (webkul).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.92%, höher als bei 60.2% aller Schwachstellen.
- Abhilfe: auf 2.3.10 oder neuer aktualisieren.
Description
Summary
SSTI when normal customer orders any product in add address step can inject value run in admin view.
Details
As normal user
- Go to
http://127.0.0.1:8000/
- Add order to cart and continue to checkout
- In step of add address inject this value {{7*7}} in any input
As admin
- Go to
http://127.0.0.1:8000/admin/sales/orders
- And notice the vlaue appear in admin view 49
As normal user
3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49
<img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />
PoC
Impact
NVD description
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free