Ecommerce-CodeIgniter-Bootstrap vulnerabilities

A vulnerability in Ecommerce-CodeIgniter-Bootstrap allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.

A deserialization vulnerability was found in the getCartItems function of ShoppingCart.php in Ecommerce-CodeIgniter-Bootstrap. The attack can be launched remotely by manipulating the shopping_cart argument. The exploit has been publicly disclosed, increasing the risk of exploitation.

A path traversal vulnerability has been identified in the Vendor Image Manager component of Ecommerce-CodeIgniter-Bootstrap. The do_upload_others_images function in AddProduct.php allows manipulation of the folder argument, enabling remote file access outside the intended directory.

A path traversal vulnerability was discovered in Ecommerce-CodeIgniter-Bootstrap up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b in the file application/modules/vendor/controllers/AddProduct.php of the Vendor Multi-Image Endpoint. An attacker can remotely manipulate the folder argument, leading to unauthorized file access. The exploit has been publicly released and may be used in attacks.

A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to version 213babdbaa949e94557246414db0130e01394517. The checkForPostRequests function in application/core/MY_Controller.php is affected by cross-site scripting via the User-Agent argument, allowing remote attacks.

A cross-site scripting vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53. The hidden REST API endpoint at /index.php/api/product/set allows remote XSS via the title/description parameters.

A vulnerability was found in Ecommerce-CodeIgniter-Bootstrap up to commit 95dfa8cebbb87ab46ae450643a07241274a74dce. The setReferrer function in application/core/MY_Controller.php is affected, and manipulation of the href argument leads to an open redirect that can be exploited remotely.