| Magento version | All Magento 1 versions |
| Cart2Quote version | v4.2.0 and above |
| Affected files |
app/code/community/Ophirah/Qquoteadv/controllers/DownloadController.php app/code/community/Ophirah/Qquoteadv/Helper/Data.php |
| Occurrence |
When you use custom file options on a product.
|
| Reason | The usage of a unserialize function in PHP when receiving this from a GET request. This can potentially be used for Remote Code Execution. |
| Solution |
Replace the unserialize and serialize functions by json_decode and json_encode functions. You can simply download and apply a patch provided below to solve the issue. |
Patches:
| Cart2Quote v4.1.6 | Download |
| Cart2Quote v4.2.0 | Download |
| Cart2Quote v4.2.01 | Download |
| Cart2Quote v4.2.02 | Download |
| Cart2Quote v4.2.1 | Download |
| Cart2Quote v4.2.11 | Download |
| Cart2Quote v4.2.2 | Download |
| Cart2Quote v4.2.3 | Download |
| Cart2Quote v4.2.11 | Download |
| Cart2Quote v4.3.0 | Download |
| Cart2Quote v4.3.1 | Download |
| Cart2Quote v4.3.3 | Download |
| Cart2Quote v4.3.4 | Download |
| Cart2Quote v4.3.6 | Download |
| Cart2Quote v4.4.0 | Download |
| Cart2Quote v4.4.1 | Download |
| Cart2Quote v4.4.2 | Download |
| Cart2Quote v4.4.3 | Download |
| Cart2Quote v4.4.4 | Download |
| Cart2Quote v4.4.5 | Download |
| Cart2Quote v5.0.1 | Download |
| Cart2Quote v5.0.3 | Download |
| Cart2Quote v5.0.4 | Download |
| Cart2Quote v5.0.5 | Download |
| Cart2Quote v5.0.10 | Download |
| Cart2Quote v5.1.0 | Download |
| Cart2Quote v5.1.1 | Download |
| Cart2Quote v5.1.2 | Download |
| Cart2Quote v5.1.3 | Download |
| Cart2Quote v5.1.4 | Download |
| Cart2Quote v5.1.5 | Download |
| Cart2Quote v5.2.0 | Download |
| Cart2Quote v5.2.1 | Download |
| Cart2Quote v5.2.2 | Download |
| Cart2Quote v5.2.3 | Download |
| Cart2Quote v5.2.4 | Download |
| Cart2Quote v5.2.5 | Download |
| Cart2Quote v5.2.6 | Download |
| Cart2Quote v5.2.7 | Download |
| Cart2Quote v5.2.8 | Download |
| Cart2Quote v5.2.9 | Download |
| Cart2Quote v5.3.0 | Download |
| Cart2Quote v5.3.1 | Download |
| Cart2Quote v5.3.2 | Download |
| Cart2Quote v5.4.0 | Download |
| Cart2Quote v5.4.1 | Download |
| Cart2Quote v5.4.2 | Download |
| Cart2Quote v5.4.3 | Download |
| Cart2Quote v5.4.4 | Download |