Eniture Technology LTL Freight Quotes – Day & Ross Edition PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the Eniture Technology LTL Freight Quotes – Day & Ross Edition plugin, affecting versions through 2.1.11. This vulnerability could potentially lead to code execution, SQL injection, path traversal, denial of service, and more, if a suitable object injection chain is exploited.

Impact

Exploitation of this vulnerability allows for PHP object injection, which could be leveraged to execute arbitrary code, inject malicious SQL, traverse file paths inappropriately, cause a denial of service, and potentially more, depending on the presence of a suitable object injection chain.

Remediation

Users of the Eniture Technology LTL Freight Quotes – Day & Ross Edition plugin should update to version 2.1.12 or later to address this vulnerability.