M2 CVE-2022-24086 and MageCart

[JonLaliberte]

I'm wondering if this is a problem for M1 as well?
Details: https://securityaffairs.co/wordpress/127999/hacking/cve-2022-24086-zero-day.html

I also saw this recently: https://sansec.io/research/naturalfreshmall-mass-hack
The root cause of the problem here is an SQL injection in a 3rd party module, but I'm wondering if there is anything that should be patched in Zend_Memory_Manager/Zend_CodeGenerator_Php_File to prevent this type of vulnerability.

[Flyingmana]

we prevented this type of vulnerability by not allowing this kind of unserialization via #1251

although it might be worth to check if the sql injection vulnerability could also apply to us

[JonLaliberte]

I believe you meant to link to #1251?

[Flyingmana]

yes, I corrected it, sorry for the confusion, copied to many links recently