The shopping_cart parameter in ShoppingCart.php’s getCartItems method is passed directly to PHP's unserialize without any validation or checks, which is a classic instance of CWE‑502 combined with an improper input validation flaw (CWE‑20). This unchecked deserialization can allow an attacker who supplies specially crafted serialized data to potentially trigger unintended behavior in the application. The CVE notes that the attack can be initiated remotely, and based on the vulnerability’s nature it is inferred that the flaw could enable arbitrary code execution if an attacker controls the serialized payload.

The issue affects the kirilkirkov Ecommerce‑CodeIgniter‑Bootstrap application. All releases up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7 contain the flaw. The vulnerability is addressed by applying the patch identified by commit 49b20f53de2b7ec34e920b11c863f1491d911a04, which removes the unsafe deserialization logic. Because the project uses continuous delivery with rolling releases, further version details beyond the highlighted commit are unavailable.

The CVSS score of 8.8 places this vulnerability in the high‑severity range, and the EPSS score indicates a very low but non‑zero probability of exploitation in the wild. Although it is not listed in the CISA KEV catalog, the confirmed remote attack capability suggest that the vulnerability could potentially be exploited by adversaries without additional conditions.