CVE-2026-14637: Ecommerce-CodeIgniter-Bootstrap RCE Flaw

CVE-2026-14637 Overview

CVE-2026-14637 is an insecure deserialization vulnerability in the kirilkirkov/Ecommerce-CodeIgniter-Bootstrap project. The flaw resides in the getCartItems function within application/libraries/ShoppingCart.php. Attackers can manipulate the shopping_cart cookie argument to trigger unsafe PHP object deserialization. The attack is exploitable remotely without authentication or user interaction, and a public exploit has been disclosed. The project uses continuous delivery with rolling releases, so no discrete affected version identifiers are published. The fix is tracked under commit 49b20f53de2b7ec34e920b11c863f1491d911a04 and GitHub Security Advisory GHSA-9g5q-g6m3-v5cr.

Critical Impact
Remote attackers can send a crafted shopping_cart cookie to invoke PHP deserialization gadgets, potentially leading to arbitrary object instantiation and downstream code execution or availability impact.

Affected Products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7
Affected component: application/libraries/ShoppingCart.php (getCartItems function)
Rolling-release distribution — no fixed version numbers assigned

Discovery Timeline

2026-07-04 - CVE-2026-14637 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14637

Vulnerability Analysis

The vulnerability is an insecure deserialization issue classified under [CWE-20] Improper Input Validation. The ShoppingCart library stores the user's cart state in a client-side cookie named shopping_cart using PHP's serialize() function. On subsequent requests, the application calls unserialize() on that cookie value to rebuild the session cart. Because the cookie is fully attacker-controlled, a remote user can supply a crafted serialized payload that instantiates arbitrary PHP objects known to the application. If any reachable class defines magic methods such as __wakeup, __destruct, or __toString, an attacker can build a POP (Property-Oriented Programming) gadget chain. The observed impact is high on availability, with lower confidentiality impact, matching the disclosed exploitation profile.

Root Cause

The root cause is trusting a client-supplied cookie as a source of PHP serialized data. The set_cookie('shopping_cart', serialize($_SESSION['shopping_cart']), ...) pattern round-trips serialized objects through the browser. Any framework or library class autoloaded during request handling becomes a candidate gadget.

Attack Vector

An unauthenticated attacker crafts a malicious shopping_cart cookie containing a serialized PHP payload. On the next request handled by getCartItems, the payload is deserialized, invoking gadget chains available in the application classpath. The attack requires only network access to the store's public endpoints.

php

                 unset($_SESSION['shopping_cart'][$key]);
             }
         }
-        @set_cookie('shopping_cart', serialize($_SESSION['shopping_cart']), $this->cookieExpTime);
+        @set_cookie('shopping_cart', json_encode($_SESSION['shopping_cart']), $this->cookieExpTime);
         $result = 0;
         if (!empty($_SESSION['shopping_cart'])) {
             $result = $this->getCartItems();

Source: GitHub Commit 49b20f53 — the patch replaces serialize() with json_encode() so the cookie is emitted as JSON, which is then parsed with json_decode() on read. JSON has no object-instantiation semantics, eliminating the gadget-chain attack surface.

Detection Methods for CVE-2026-14637

Indicators of Compromise

Inbound HTTP requests with a shopping_cart cookie beginning with PHP serialized type tokens such as O:, a:, or s: instead of a JSON structure.
Unexpected class instantiations or __destruct/__wakeup invocations in PHP error logs around cart-related endpoints.
Web server processes spawning child processes (shells, curl, wget) during checkout or cart page requests.

Detection Strategies

Inspect WAF and reverse-proxy logs for shopping_cart cookie values matching the regex ^[Oa]:\d+: which indicates a PHP serialized object or array.
Compare production ShoppingCart.php against the patched commit 49b20f53de2b7ec34e920b11c863f1491d911a04 to confirm json_encode is used in place of serialize.
Correlate anomalous cart-endpoint requests with subsequent process execution, file writes to web roots, or outbound connections from the PHP-FPM worker.

Monitoring Recommendations

Enable full request logging for cart endpoints and archive cookie headers for retrospective analysis.
Alert on PHP unserialize() warnings and notices in application logs, which often accompany failed gadget attempts.
Monitor filesystem changes under the web root and CodeIgniter cache directories.

How to Mitigate CVE-2026-14637

Immediate Actions Required

Apply the upstream patch by pulling commit 49b20f53de2b7ec34e920b11c863f1491d911a04 or a later main branch state.
Invalidate all existing shopping_cart cookies and force re-issuance after deployment.
Deploy a WAF rule to reject shopping_cart cookie values that do not parse as valid JSON.

Patch Information

The maintainer fixed the issue in commit 49b20f53de2b7ec34e920b11c863f1491d911a04, tracked in GHSA-9g5q-g6m3-v5cr. The fix replaces serialize()/unserialize() on the client cookie with json_encode()/json_decode(), removing the object-instantiation path. Because the project uses rolling releases, redeploy from the current main branch after verifying the patch is present.

Workarounds

Server-side store the cart in the PHP session or database and use only an opaque session identifier in the cookie.
If patching is delayed, drop the shopping_cart cookie at the reverse proxy or WAF and rebuild carts server-side.
Restrict PHP class autoloading so unused classes are not reachable during request handling, reducing gadget availability.

bash

# Nginx snippet to strip attacker-supplied shopping_cart cookies as a temporary control
map $http_cookie $sanitized_cookie {
    default $http_cookie;
    "~*(^|;\s*)shopping_cart=(O|a|s):" "";
}

server {
    location ~ \.php$ {
        proxy_set_header Cookie $sanitized_cookie;
        fastcgi_param  HTTP_COOKIE $sanitized_cookie;
    }
}