Junglewise Threat Intelligence

CVE-2026-14637: kirilkirkov Ecommerce-CodeIgniter-Bootstrap deserialization in ShoppingCart

CVE-2026-14637 · Severity: high · CVSS 8.2 · Published 2026-07-04

Technologies: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap. Vendors: Kirilkirkov.

Executive brief

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap shopping cart platform. An attacker can exploit this flaw by sending a specially crafted browser cookie to the website. This can cause the online store to crash (denial of service) and may reveal sensitive internal technical details about the server's file structure to the attacker.

Technical details

An unsafe deserialization vulnerability exists in the `getCartItems` function within `application/libraries/ShoppingCart.php`. The application uses the PHP `unserialize()` function on the contents of the `shopping_cart` cookie without prior validation. A remote, unauthenticated attacker can provide a serialized object instead of the expected array, causing a fatal error (HTTP 500) when the application attempts to process the object as a string during database query building. This results in a denial of service for the shopping cart functionality and discloses internal stack traces and filesystem paths. The issue has been addressed in commit 49b20f5 by replacing PHP serialization with JSON encoding and implementing integer validation for product IDs.

Affected products

  • kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Timeline

  • 2026-05-20: advisory: GitHub Security Advisory GHSA-9g5q-g6m3-v5cr published
  • 2026-05-20: patched: Fix committed to master branch
  • 2026-07-04: disclosed: CVE-2026-14637 published to NVD

References

Related threats