Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24746

CVE-2022-24746:
HTML injection possibility in voucher code form in Shopware

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24746
GHSA ID
GHSA-952p-fqcp-g8pc
EPSS Score
0.70156%
CWE
CWE-79
Published
3/10/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
shopware/platformcomposer<= 6.4.8.06.4.8.1
shopware/corecomposer<= 6.4.8.06.4.8.1
shopware/storefrontcomposer<= 6.4.8.06.4.8.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from unsanitized user input in error message contexts. The commit patching CVE-2022-24746 adds HtmlSanitizer to both promotion code handling (PromotionCollector) and product number handling (CartLineItemController). The test cases explicitly verify HTML sanitization for both vectors, confirming these were injection points. Pre-patch versions lacked output encoding when embedding user-controlled values into HTML responses through error messages.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *TML inj**tion possi*ility in vou***r *o** *orm ## P*t***s P*t**** in *.*.*.*, m*int*in*rs r**omm*n* up**tin* to t** *urr*nt v*rsion *.*.*.*. You **n **t t** up**t* to *.*.*.* r**ul*rly vi* t** *uto-Up**t*r or *ir**tly vi* t** *ownlo** ov

Reasoning

T** vuln*r**ility st*mm** *rom uns*nitiz** us*r input in *rror m*ss*** *ont*xts. T** *ommit p*t**in* *V*-****-***** ***s `*tmlS*nitiz*r` to *ot* promotion *o** **n*lin* (`Promotion*oll**tor`) *n* pro*u*t num**r **n*lin* (`**rtLin*It*m*ontroll*r`). T*