https://feed.craftedsignal.io/vendors/kirilkirkov/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 04 Jul 2026 18:21:02 +0000https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14637-deserialization/Sat, 04 Jul 2026 18:21:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14637-deserialization/A high-severity deserialization vulnerability, CVE-2026-14637, exists in the `getCartItems` function of `application/libraries/ShoppingCart.php` in kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to commit `13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7`, allowing remote attackers to achieve arbitrary code execution by manipulating the `shopping_cart` argument, with public exploit disclosure raising immediate risk.A significant deserialization vulnerability, identified as CVE-2026-14637, has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap, affecting all versions up to and including commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. This flaw resides within the getCartItems function of the application/libraries/ShoppingCart.php library. Attackers can remotely exploit this by manipulating the shopping_cart argument in web requests, which leads to insecure deserialization on the server. The vulnerability allows for arbitrary code execution, posing a critical risk to affected systems. An exploit for this issue has been publicly disclosed, meaning attackers can readily leverage it. Due to the product's continuous delivery model, specific version numbers are not available; instead, defenders are advised to apply the patch associated with commit 49b20f53de2b7ec34e920b11c863f1491d911a04 to mitigate immediate threats.

Attack Chain

1. An unauthenticated remote attacker crafts a malicious HTTP request (GET or POST) targeting a vulnerable kirilkirkov Ecommerce-CodeIgniter-Bootstrap instance.
2. The attacker includes a specially constructed shopping_cart argument in the HTTP request's parameters (e.g., query string or request body).
3. This shopping_cart argument contains serialized PHP objects specifically designed to trigger malicious behavior upon deserialization.
4. The vulnerable application/libraries/ShoppingCart.php library, particularly the getCartItems function, processes the incoming request.
5. The getCartItems function attempts to deserialize the attacker-controlled shopping_cart data without proper validation or sanitization.
6. During the insecure deserialization process, the crafted object triggers arbitrary code execution on the underlying web server, allowing the attacker to run commands.
7. Upon successful execution, the attacker can achieve remote code execution, enabling actions like web shell deployment, data exfiltration, or further system compromise.
8. The attacker establishes persistence or moves laterally within the compromised environment to achieve their final objective.

Impact

Successful exploitation of CVE-2026-14637 grants remote attackers arbitrary code execution on the server hosting the Ecommerce-CodeIgniter-Bootstrap application. With a CVSS v3.1 Base Score of 8.2 (High), this vulnerability can lead to complete system compromise, including unauthorized access to sensitive data, modification or deletion of website content, and disruption of service. Given the public disclosure of an exploit, organizations using this product are at immediate and significant risk of attack, potentially resulting in data breaches, financial losses, and reputational damage.

Recommendation

• Prioritize patching CVE-2026-14637 by applying the commit 49b20f53de2b7ec34e920b11c863f1491d911a04 to all instances of kirilkirkov Ecommerce-CodeIgniter-Bootstrap immediately.
• Monitor webserver logs (category webserver) for HTTP requests targeting application/libraries/ShoppingCart.php that contain unusually long, malformed, or encoded shopping_cart argument values, which could indicate exploitation attempts for CVE-2026-14637.
• Review access logs for any suspicious process creation or outbound connections from the web server after a suspected exploitation attempt, as these could signal post-exploitation activity.

]]>highadvisorydeserializationremote-code-executionweb-vulnerabilityphpcodeigniterhttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14635-path-traversal/Sat, 04 Jul 2026 17:19:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14635-path-traversal/A high-severity path traversal vulnerability (CVE-2026-14635) has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to commit 222ff31c066, allowing remote attackers to access or modify arbitrary files by manipulating the 'folder' argument in the Vendor Multi-Image Endpoint, with a public exploit available.A critical path traversal vulnerability, CVE-2026-14635, has been publicly disclosed and is actively exploitable in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This flaw specifically impacts the Vendor Multi-Image Endpoint, residing in the application/modules/vendor/controllers/AddProduct.php file. Remote attackers can leverage this vulnerability by manipulating the 'folder' argument within HTTP requests, allowing them to traverse directory structures and potentially access or modify arbitrary files outside the intended web root. The lack of traditional versioning due to the product's rolling release model means all installations prior to the patch commit are affected. A public exploit has been released, significantly increasing the risk of widespread exploitation. Defenders must prioritize applying patch 2a9497ff11f36e573ad99e1c357ff0e6ded49745 to mitigate this severe risk.

Attack Chain

1. An unauthenticated remote attacker identifies an internet-facing instance of kirilkirkov Ecommerce-CodeIgniter-Bootstrap.
2. The attacker crafts a malicious HTTP POST request targeting the vulnerable application/modules/vendor/controllers/AddProduct.php endpoint.
3. The request includes a specially crafted folder argument containing directory traversal sequences, such as ../../../../ or its URL-encoded variants.
4. The AddProduct.php component processes the folder argument without proper sanitization or validation of the input path.
5. The application attempts to access, create, or modify a file at a location outside its intended directory, dictated by the attacker's manipulated folder argument.
6. The attacker successfully gains unauthorized access to sensitive system files (e.g., /etc/passwd, configuration files), or writes malicious content like web shells to accessible directories.
7. If a web shell is successfully deployed, the attacker can achieve remote code execution and further compromise the underlying server.

Impact

The successful exploitation of CVE-2026-14635 can lead to severe consequences, including unauthorized access to sensitive system files, configuration files, and potentially user data. Attackers could also write malicious web shells to the server, leading to full remote code execution and complete system compromise. The availability of a public exploit significantly increases the likelihood of opportunistic attacks targeting vulnerable instances. Organizations failing to patch face data breaches, system defacement, or complete loss of control over their web application and underlying server infrastructure.

Recommendation

• Patch CVE-2026-14635 immediately by applying commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 to your kirilkirkov Ecommerce-CodeIgniter-Bootstrap installation.
• Deploy the Sigma rule provided in this brief to your web server logs (category: webserver) to detect exploitation attempts.
• Ensure comprehensive web server access logging is enabled to capture full HTTP request details, including URI path and query strings, for improved detection and forensic analysis.

]]>highadvisorypath-traversalweb-applicationcodeignitercve