CVE-2014-3990

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611 CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://karmainsecurity.com/KIS-2014-08Exploit, Third Party Advisory
http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Jul/67Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/532763/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/68529Third Party Advisory, VDB Entry
https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076fIssue Tracking, Patch, Third Party Advisory
http://karmainsecurity.com/KIS-2014-08Exploit, Third Party Advisory
http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Jul/67Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/532763/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/68529Third Party Advisory, VDB Entry
https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076fIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-39914.3Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML CVE-2014-39926.5Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the CVE-2014-39944.3Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as u CVE-2014-39954.3Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django a CVE-2014-39967.5SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Pro CVE-2014-39977.5SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi CVE-2014-39998.1The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user CVE-2014-40008.8Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted se CVE-2014-40024.3Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1 CVE-2014-40037.5The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.CVE-2014-40045.0The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier fo CVE-2014-40055.0SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.