Code injection

2022-09-0207:15:00

PRIOn knowledge base

www.prio-n.com

apache ofbiz

code injection

versions 18.12.05

ecommerce plugin

anonymous user

malicious content

message subject

party manager

communications

ssti

rce

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.5%

JSON

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the “Contact us” page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.