[KIS-2014-08] OpenCart PHP Object Injection Vulnerability

[wookiecooking]

http://seclists.org/bugtraq/2014/Jul/64

[jamesallsup]

This has already been patched on 1.5.6.x and master branches.

[danielkerr]

This is a bug not a vulnerability. what's reported here has been completely untested as "DBMySQLi“ requires a connection to be initialised. As for the XML External Entity (XXE) attacks well the person who reported this issue is to stupid to realise the same filters that block html being sent in customer inputs would also filter xml being used.

its amazing that low life's such as (Egidio Romano) manage to pass them self s off as security professionals.