Eniture Technology LTL Freight Quotes - TQL Edition PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the Eniture Technology LTL Freight Quotes - TQL Edition plugin, affecting versions through 1.2.6. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited to inject objects that may lead to various types of code execution or manipulation, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which could be leveraged to execute code, perform SQL injection, traverse directories in an unauthorized manner, cause a denial-of-service condition, or other impacts, provided a suitable object injection chain is available.

Remediation

Users of the Eniture Technology LTL Freight Quotes - TQL Edition plugin should update to version 1.2.7 or later to address this vulnerability.