CVE-2022-24108

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/167197/OpenCart-So-Listing-Tabs-2.2.0-Unsafe-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://codecanyon.net/item/so-listing-tabs-responsive-opencart-module/12388133Product, Third Party Advisory
https://seclists.org/fulldisclosure/2022/May/30Exploit, Mailing List, Third Party Advisory
https://www.smartaddons.com/opencart-extensions/so-listing-tabs-responsive-opencart-30x-opencart-2x-moduleProduct, Third Party Advisory
http://packetstormsecurity.com/files/167197/OpenCart-So-Listing-Tabs-2.2.0-Unsafe-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://codecanyon.net/item/so-listing-tabs-responsive-opencart-module/12388133Product, Third Party Advisory
https://seclists.org/fulldisclosure/2022/May/30Exploit, Mailing List, Third Party Advisory
https://www.smartaddons.com/opencart-extensions/so-listing-tabs-responsive-opencart-30x-opencart-2x-moduleProduct, Third Party Advisory

Timeline

Published: May 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-241096.5An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with CVE-2022-24114.8The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2022-241106.5Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.CVE-2022-241115.3In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and p CVE-2022-241129.8An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apach CVE-2022-241137.8Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Prot CVE-2022-241147.0Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Off CVE-2022-241157.8Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Hom CVE-2022-241169.8Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.CVE-2022-241179.8Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0,CVE-2022-241189.1Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration.CVE-2022-241199.8Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell