GHSA-gg2f-r4jh-vpmh

TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

Source: GitHub Advisory Database (reviewed) High CVE-2024-44313

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	tastyigniter/tastyigniter	< 4.0.0	4.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-44313 advisory
https://github.com/tastyigniter/TastyIgniter package
https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php web
https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74 web