Unrated
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
Type: withdrawalSources: OSV
# Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. # Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by utilizing the unserialize function when processing data from a GET request. This flaw, present in the app/code/community/Ophirah/Qquoteadv/controllers/DownloadController.php and app/code/community/Ophirah/Qquoteadv/Helper/Data.php files, poses a significant risk of Remote Code Execution, especially when custom file options are employed on a product. Attackers exploiting this vulnerability could execute arbitrary code remotely, leading to unauthorized access and potential compromise of sensitive data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 04:12 UTC · Revision 1
Source evidence
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
core-osv · Original sourcePublished 15 May 2024, 18:06 UTC
# Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. # Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by utilizing the unserialize function when processing data from a GET request. This flaw, present in the app/code/community/Ophirah/Qquoteadv/controllers/DownloadController.php and app/code/community/Ophirah/Qquoteadv/Helper/Data.php files, poses a significant risk of Remote Code Execution, especially when custom file options are employed on a product. Attackers exploiting this vulnerability could execute arbitrary code remotely, leading to unauthorized access and potential compromise of sensitive data.
osv:GHSA-pgj4-g5j4-cmfx
cart2quote/module-quotation-encoded
Fixed versions: Not specified
cart2quote/module-quotation-encoded
Fixed versions: 5.4.4
cart2quote/module-quotation
Fixed versions: 4.4.6
cart2quote/module-quotation
Fixed versions: 5.4.4
Complete source record
{
"id": "122917ad2e76fee00ab2cab4a7625242154a7e57a72d0f3618e2b3c5070d42eb",
"url": "https://osv.dev/vulnerability/GHSA-pgj4-g5j4-cmfx",
"method": "structured",
"payload": {
"kind": "withdrawal",
"title": "Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction",
"summary": "# Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. # Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by utilizing the unserialize function when processing data from a GET request. This flaw, present in the app/code/community/Ophirah/Qquoteadv/controllers/DownloadController.php and app/code/community/Ophirah/Qquoteadv/Helper/Data.php files, poses a significant risk of Remote Code Execution, especially when custom file options are employed on a product. Attackers exploiting this vulnerability could execute arbitrary code remotely, leading to unauthorized access and potential compromise of sensitive data.",
"evidence": "osv:GHSA-pgj4-g5j4-cmfx",
"products": [
{
"name": {
"value": "cart2quote/module-quotation-encoded",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.2",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.3",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.4",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.5",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.6",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.7",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.8",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.9",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.10",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.11",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.12",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.2",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.3",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.4",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.5",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.6",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.7",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.8",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.9",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.2",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.3",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.4",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.5",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "cart2quote/module-quotation-encoded",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "5.0.0",
"evidence": "/affected/1/versions"
},
{
"value": "5.0.1",
"evidence": "/affected/1/versions"
},
{
"value": "5.0.2",
"evidence": "/affected/1/versions"
},
{
"value": "5.0.3",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.0",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.1",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.2",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.3",
"evidence": "/affected/1/versions"
},
{
"value": "5.2.0",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "cart2quote/module-quotation",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.4.6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cart2quote/module-quotation",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.4",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "GHSA-pgj4-g5j4-cmfx",
"aliases": [
"GHSA-pgj4-g5j4-cmfx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.1.6"
},
{
"last_affected": "4.4.5"
}
]
}
],
"package": {
"name": "cart2quote/module-quotation-encoded",
"purl": "pkg:composer/cart2quote/module-quotation-encoded",
"ecosystem": "Packagist"
},
"versions": [
"4.2.0",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.2.6",
"4.2.7",
"4.2.8",
"4.2.9",
"4.3.0",
"4.3.1",
"4.3.10",
"4.3.11",
"4.3.12",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.7",
"4.3.8",
"4.3.9",
"4.4.0",
"4.4.1",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-pgj4-g5j4-cmfx/GHSA-pgj4-g5j4-cmfx.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.4"
}
]
}
],
"package": {
"name": "cart2quote/module-quotation-encoded",
"purl": "pkg:composer/cart2quote/module-quotation-encoded",
"ecosystem": "Packagist"
},
"versions": [
"5.0.0",
"5.0.1",
"5.0.2",
"5.0.3",
"5.1.0",
"5.1.1",
"5.1.2",
"5.1.3",
"5.2.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-pgj4-g5j4-cmfx/GHSA-pgj4-g5j4-cmfx.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.1.6"
},
{
"fixed": "4.4.6"
}
]
}
],
"package": {
"name": "cart2quote/module-quotation",
"purl": "pkg:composer/cart2quote/module-quotation",
"ecosystem": "Packagist"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-pgj4-g5j4-cmfx/GHSA-pgj4-g5j4-cmfx.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.4"
}
]
}
],
"package": {
"name": "cart2quote/module-quotation",
"purl": "pkg:composer/cart2quote/module-quotation",
"ecosystem": "Packagist"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-pgj4-g5j4-cmfx/GHSA-pgj4-g5j4-cmfx.json"
}
}
],
"modified": "2026-10-07T14:16:42.441487487Z",
"provider": "osv",
"references": [
"https://github.com/github/advisory-database/pull/8423",
"https://bitbucket.org/cart2quote2/cart2quote2-releases",
"https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction",
"https://github.com/FriendsOfPHP/security-advisories/blob/master/cart2quote/module-quotation/2017-02-01.yaml",
"https://web.archive.org/web/20230131172111/https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2024-05-15T18:06:58Z"
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 95082,
"published_at": "2024-05-15T18:06:58+00:00"
}