| Package | Affected versions | Patched versions |
|---|---|---|
| bagisto/bagisto | < 2.3.10 | 2.3.10 |
| bagisto | < 2.3.10 | 2.3.10 |
SSTI when normal customer orders any product in add address step can inject value run in admin view.
As normal user
http://127.0.0.1:8000/As admin
http://127.0.0.1:8000/admin/sales/ordersAs normal user
3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49
<img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free