CVE-2024-27499: 
PHP vulnerability analysis and mitigation

Bagisto v1.5.1 contains a Cross-Site Scripting (XSS) vulnerability that can be exploited through PNG file uploads in the product review feature. The vulnerability was discovered and reported in March 2024, affecting Bagisto versions prior to 2.1.0 (GitHub Security, FortiGuard Labs).

The vulnerability exists in the product review functionality where PNG files can be uploaded. The application fails to properly validate and sanitize the uploaded PNG files, allowing attackers to inject malicious scripts. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility with low attack complexity (NVD).

When successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers, particularly when administrators view the malicious review images. This could lead to unauthorized access to user information, session hijacking, or other client-side attacks (GitHub Security).

The vulnerability can be exploited by uploading a specially crafted PNG file containing malicious JavaScript code through the product review feature. When an administrator opens the review image in a new tab, the malicious payload executes in their browser context (GitHub Security).

Users are advised to upgrade to Bagisto version 2.1.0 or later, which contains fixes for this vulnerability. The issue has been addressed through a security patch that properly validates and sanitizes file uploads in the product review system (FortiGuard Labs).