Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Summary

SSTI when normal customer orders any product in add address step can inject value run in admin view.

Details

As normal user

1. Go to http://127.0.0.1:8000/
2. Add order to cart and continue to checkout
3. In step of add address inject this value {{7*7}} in any input

As admin

1. Go to http://127.0.0.1:8000/admin/sales/orders
2. And notice the vlaue appear in admin view 49

As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49

PoC

• Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d

Impact

• Can lead to RCE