GHSA-ggmw-mjhv-75rm

NietThijmen ShoppingCart: Command injection in the connect function

Source: GitHub Advisory Database (reviewed) High CVE-2024-53412

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/NietThijmen/ShoppingCart	<= 0.0.0-20241101155353-3dd137080276	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-53412 advisory
https://github.com/NietThijmen/ShoppingCart/issues/1 web
https://github.com/Buckdray/vulnerability-research/blob/main/CVE-2024-53412/README.md web
https://github.com/NietThijmen/ShoppingCart package
https://github.com/advisories/GHSA-ggmw-mjhv-75rm advisory