CVE-2024-44314 Information

Description

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php which fails to verify if the user has permission to modify an order’s status. This flaw can be exploited remotely leading to unauthorized order manipulation.

Reference

https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php https://medium.com/@cnetsec/cve-2024-44314-incorrect-access-control-in-function-updateorder-fc5f2b1b0467