Threats affecting pkg:composer/Thelia

Thelia versions before 3.1.5 and 3.2.x before 3.2.4 have a business logic vulnerability that allows authenticated customers to bypass coupon usage limits. This occurs because coupon usage is only counted when orders become paid, enabling attackers to place multiple pay-later orders or cancel paid orders to inflate usage counts and gain unlimited discounts.

Thelia version 2.6.1 has an absolute path traversal vulnerability in its Smarty template handling. This flaw allows an authorized user to supply an absolute filesystem path as a template, bypassing the relative path traversal checks. As a result, Smarty loads and compiles the specified file without effective security restrictions, potentially enabling server-side template injection (SSTI) and remote code execution with the web server's privileges.

Thelia version 2.6.0 allows authenticated administrators to upload and install modules via a ZIP upload function without proper validation or sandboxing of embedded PHP code. This vulnerability enables execution of malicious PHP code included in a module's install() method during installation, resulting in remote code execution with the web server's privileges.

Thelia version 2.6.0 contains multiple stored cross-site scripting (XSS) vulnerabilities in its administrative interface. These vulnerabilities arise from insufficient output encoding or sanitization of user-supplied input, which is stored and later rendered in administrator pages and product pages. This allows arbitrary JavaScript execution when the affected pages are viewed, impacting administrative functions such as category and product creation.