CVE-2024-31820

Deeper analysis

CVE-2024-31820 is a remote code execution vulnerability in the Ecommerce-CodeIgniter-Bootstrap project at commit d22b54e8915f167a135046ceb857caaf8479c4da. The flaw resides in the getLangFolderForEdit method of the Languages.php component and is tracked under CWE-89. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the affected method and execute arbitrary code on the server. Successful exploitation grants the attacker the same privileges as the web application process, enabling data exfiltration, modification of application data, or deployment of additional malicious payloads.

The EPSS score has remained flat at 0.074 since disclosure, indicating no material increase in observed exploitation interest. Public references consist of a technical write-up and the vulnerable commit but contain no vendor advisory or patch guidance.