| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/basket | < 2.1.17 | 2.1.17 |
| alternativecommerce | < 2.1.17 | 2.1.17 |
The Basket module enables e-commerce and checkout functionality for Drupal sites.
The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize().
An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free