Threats affecting pkg:github/TastyIgniter

TastyIgniter versions up to 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to execute arbitrary code. This occurs because serialized PHP objects submitted via the admin settings form are stored without sanitization and later unserialized, enabling execution of malicious payloads. The vulnerability can be exploited by submitting a crafted serialized object, such as one generated by phpggc, leading to arbitrary operating system command execution as the PHP process user. The malicious setting value remains effective until overwritten.

Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.