What is the CVSS score of CVE-2024-31823?

CVE-2024-31823 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Ecommerce-CodeIgniter-Bootstrap are affected by CVE-2024-31823?

Ecommerce-CodeIgniter-Bootstrap contains a critical vulnerability allowing unauthenticated remote attackers to delete arbitrary files from web servers running the application, impacting both data…. A patch is available.

Is there a public PoC exploit available for CVE-2024-31823?

Yes, a public proof-of-concept exploit is available for CVE-2024-31823. Prioritise patching immediately. EPSS: 1.6%.

How to fix or mitigate CVE-2024-31823?

Within 24 hours, deploy a Web Application Firewall rule to block or restrict the removeSecondaryImage endpoint, filtering requests containing path-traversal characters (../ and URL-encoded variants), and communicate to development teams that critical patching is required. Within 7 days, apply the vendor-released patch to all production and development instances of Ecommerce-CodeIgniter-Bootstrap, perform regression testing to confirm patch efficacy, and verify that the endpoint's folder and image parameters properly sanitize input. Within 30 days, audit server filesystem logs to identify any unauthorized file deletions that occurred during the exposure period, implement endpoint-level authentication requirements as defense-in-depth, and establish automated security scanning for path-traversal vulnerabilities across all file-operation endpoints.

Ecommerce-CodeIgniter-Bootstrap CVE-2024-31823

CRITICAL

Code Injection (CWE-94)

2024-04-29 cve@mitre.org

PHP RCE Code Injection Ecommerce Codeigniter Bootstrap Ecommerce Codeigniter Bootstrap Project

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Named sink is unlink() path traversal reachable over HTTP in an admin controller, so AV:N/AC:L with PR:L for likely back-office auth; impact is file deletion (I:H/A:H), no read so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 24, 2026 - 14:29 vuln.today

Analysis Updated

Aug 24, 2026 - 14:29 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 14:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 14:22 NVD

HIGH CRITICAL

CVSS changed

Aug 24, 2026 - 14:22 NVD

8.8 (HIGH) 9.8 (CRITICAL)

CVE Published

Apr 29, 2024 - 18:15 cve.org

HIGH 8.8

DescriptionCVE.org

An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.

AnalysisAI

Remote attackers can abuse the removeSecondaryImage endpoint in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap (snapshot dated 2024-01-02, commit d22b54e) to manipulate the server filesystem through unsanitized POST parameters. NVD classifies this as CWE-94 code injection with a 9.8 CVSS score, but the referenced fix commit shows the removeSecondaryImage method actually passing attacker-controlled folder/image values straight into unlink(), which is an arbitrary file-deletion / path-traversal weakness rather than direct code execution. Publicly available exploit code exists (LioTree gist and write-up) and EPSS is moderate at 1.64% (74th percentile); there is no CISA KEV listing.

Technical ContextAI

The product is a PHP e-commerce storefront built on the CodeIgniter MVC framework with a Bootstrap admin UI, distributed as an open-source GitHub project (CPE cpe:2.3:a:ecommerce-codeigniter-bootstrap_project:ecommerce-codeigniter-bootstrap:2024-01-02). The advisory assigns CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable code in application/modules/admin/controllers/ecommerce/Publish.php built a filesystem path by directly concatenating $_POST['folder'] and $_POST['image'] into an attachments/shop_images path and calling unlink() with no canonicalization - a classic path-traversal primitive (CWE-22 in practice). Notably, the SAME patch commit also hardens Languages.php (saveLanguageFiles), where user-supplied php_keys/js_keys were written verbatim into included PHP/JS language files and only later guarded with addslashes()/ctype_alnum; that Languages.php path is the code that genuinely matches the CWE-94 code-injection label, suggesting the CVE may conflate two distinct fixes shipped in one commit.

RemediationAI

Upstream fix available (commit d22b54e8915f167a135046ceb857caaf8479c4da); released patched version not independently confirmed - apply that commit from https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da or pull the latest main branch, since the project ships from Git rather than tagged releases. The patch canonicalizes the deletion path with realpath() and verifies the resolved folder stays within the attachments/shop_images base directory before calling unlink(); it also hardens the Languages.php language-file writer and Orders_model SQL. If you cannot patch immediately: restrict access to the /admin/publish endpoints (enforce and verify admin authentication and, if possible, IP-allowlist the back office), and add a WAF/reverse-proxy rule rejecting removeSecondaryImage POST bodies whose folder or image parameters contain path-traversal sequences (../, encoded variants, absolute paths, or DIRECTORY_SEPARATOR) - note this can break legitimate image removal if folder names legitimately contain such characters. Run the PHP process as a low-privilege user with write access confined to the attachments tree so a traversal cannot delete application or system files.