Skip to content

Commit c30127f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-875v-7m49-8x88 GHSA-r54v-qq87-px5r GHSA-x9h5-r9v2-vcww
1 parent 6fe8026 commit c30127f

File tree

3 files changed

+540
-0
lines changed

3 files changed

+540
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-875v-7m49-8x88/GHSA-875v-7m49-8x88.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-875v-7m49-8x88",
4+
"modified": "2026-04-14T00:07:34Z",
5+
"published": "2026-04-14T00:07:34Z",
6+
"aliases": [
7+
"CVE-2026-32271"
8+
],
9+
"summary": "Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget",
10+
"details": "## Summary\n\nA SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities:\n\n* SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks.\n\n* PDO Multi-Statement Queries -- PHP `PDO MySQL` enables `CLIENT_MULTI_STATEMENTS` by default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table.\n\n* Unrestricted `unserialize()` -- The yii2-queue PhpSerializer calls `unserialize()` with no allowed_classes restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object.\n\n* Gadget Chain (FileCookieJar) -- `GuzzleHttp\\Cookie\\FileCookieJar` (a standard Guzzle dependency) has an unguarded `__destruct()` method that calls `file_put_contents()`. The attacker’s serialized payload writes a PHP webshell to the server’s webroot. PHP tags survive `json_encode()` because Guzzle uses `options=0` (no `JSON_HEX_TAG`).\n\nThe complete chain requires 3 HTTP requests and achieves arbitrary command execution as the PHP process user. Queue processing is triggered via GET `/actions/queue/run`, an endpoint that requires no authentication (`$allowAnonymous = ['run']`).\n\n## RCE Exploitation Steps\n\n* Authenticate as any control panel user\n* POST to `/admin/actions/dashboard/create-widget` with stacked SQL injection:\n* `settings[type]` contains the stacked INSERT with the serialized gadget chain\n* Response: HTTP 500 (expected -- INSERT already committed)\n* Trigger queue processing: `GET /actions/queue/run`\n* Queue consumer deserializes the gadget chain\n* `FileCookieJar::__destruct()` writes webshell to webroot\n* Access the webshell: `GET /poc_rce.php?c=id`\n* Response: `uid=1000(home) gid=1000(home) groups=1000(home)`",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/commerce"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0"
29+
},
30+
{
31+
"fixed": "4.10.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.10.2"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "craftcms/commerce"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "5.0.0"
51+
},
52+
{
53+
"fixed": "5.5.5"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 5.5.4"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32271"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c06593856d05446f82bd8af92d72"
75+
},
76+
{
77+
"type": "PACKAGE",
78+
"url": "https://github.com/craftcms/commerce"
79+
}
80+
],
81+
"database_specific": {
82+
"cwe_ids": [
83+
"CWE-89"
84+
],
85+
"severity": "HIGH",
86+
"github_reviewed": true,
87+
"github_reviewed_at": "2026-04-14T00:07:34Z",
88+
"nvd_published_at": "2026-04-13T21:16:24Z"
89+
}
90+
}

‎advisories/github-reviewed/2026/04/GHSA-r54v-qq87-px5r/GHSA-r54v-qq87-px5r.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r54v-qq87-px5r",
4+
"modified": "2026-04-14T00:06:56Z",
5+
"published": "2026-04-14T00:06:56Z",
6+
"aliases": [
7+
"CVE-2026-32272"
8+
],
9+
"summary": "Craft Commerce hasVariant/hasProduct Blind SQL Injection",
10+
"details": "## Overview\n\nCraft Commerce’s `ProductQuery::hasVariant` and `VariantQuery::hasProduct` properties bypass the `unset()` blocklist added to `ElementIndexesController` in GHSA-2453-mppf-46cj.\n\nThe blocklist only strips top-level Yii2 Query properties (`where`, `orderBy`, etc.), but `hasVariant` and `hasProduct` pass\nthrough untouched. Internally, these properties call `Craft::configure()` on a subquery without sanitization, re-introducing SQL injection via `criteria[hasVariant][where]=INJECTED_SQL`.\n\nAn authenticated control panel user can perform boolean-based blind SQL injection through the patched `ElementIndexesController` and extract arbitrary database contents.\n\n## Impact\n\n* Full database read access via blind SQL injection\n* Privilege escalation via security key extraction → forged admin sessions\n\n## Prerequisites\n* Authenticated control panel user\n* Commerce plugin installed\n* Products with variants in the database",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/commerce"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.0.0"
29+
},
30+
{
31+
"fixed": "5.6.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32272"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/craftcms/commerce/pull/4232"
50+
},
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/advisories/GHSA-2453-mppf-46cj"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/craftcms/commerce"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/craftcms/commerce/releases/tag/5.6.0"
62+
}
63+
],
64+
"database_specific": {
65+
"cwe_ids": [
66+
"CWE-89"
67+
],
68+
"severity": "HIGH",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-04-14T00:06:56Z",
71+
"nvd_published_at": "2026-04-13T21:16:24Z"
72+
}
73+
}

0 commit comments

Comments
 (0)