Bagisto Server-Side Template Injection Vulnerability Allowing Remote Code Execution

A server-side template injection vulnerability has been identified in Bagisto versions prior to 2.3.10. This vulnerability allows normal customers to inject values during the 'add address' step of the checkout process, which are then executed in the admin view. The injected values can be manipulated to achieve remote code execution.

Impact

Exploitation of this vulnerability can lead to remote code execution on the server.

Reproduction

To reproduce this vulnerability, a normal user can place an order and inject a template expression, such as '{{7*7}}', into any input field during the 'add address' step. This injected value will be executed and the result, '49', will appear in the admin view under 'sales orders'. The same injection can be performed directly in the 'customer account addresses' section, with the same result.

Remediation

Users can upgrade to Bagisto version 2.3.10, which includes a patch for this vulnerability.