Cyber Posture

CVE-2024-44313

HighPublic PoC

Published: 18 March 2025

Published
18 March 2025
Modified
02 April 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0137 80.3th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

TastyIgniter version 3.7.6 is affected by CVE-2024-44313, an Incorrect Access Control vulnerability (CWE-284) in the invoice() function within the Orders.php file located at app/admin/controllers/Orders.php. This flaw arises from missing permission checks, enabling unauthorized access to sensitive invoice generation functionality. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts over the network.

An attacker with low privileges (PR:L), such as a registered user with basic access, can exploit this vulnerability remotely with low complexity and no user interaction required. By invoking the invoice() function without proper authorization, the attacker gains unauthorized access to other users' invoices, allowing them to view sensitive order details and generate fraudulent or manipulated invoice documents. This compromises high levels of confidentiality and integrity but does not affect availability.

References for mitigation include the vulnerable source code in the TastyIgniter GitHub repository at https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php and a detailed disclosure on Medium at https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74. Security practitioners should review these for implementation of permission checks or upgrades beyond version 3.7.6.

Details

CWE(s)
CWE-284

Affected Products

tastyigniter
tastyigniter
3.7.6

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an access control flaw (missing permission checks) in a web application's invoice generation function, allowing a low-privileged authenticated user to access restricted sensitive data and functionality. This directly enables exploitation of the public-facing application (T1190) and exploitation for privilege escalation to unauthorized data access and manipulation (T1068).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References