CVE-2024-40420: openCart Server-Side Template Injection (SSTI) vulnerability

July 17, 2024 (updated November 18, 2024)

A Server-Side Template Injection (SSTI) vulnerability in the edit theme function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload.

References

github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md
github.com/advisories/GHSA-xrh7-2gfq-4rcq
github.com/opencart/opencart
nvd.nist.gov/vuln/detail/CVE-2024-40420

Code Behaviors & Features

Detect and mitigate CVE-2024-40420 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →