CyberRota Analysis
AI-GeneratedSolidInvoice versions prior to 3.0.1 are vulnerable due to the insecure deserialization of the `context` prop in the `DataGrid` LiveComponent, allowing authenticated attackers to inject arbitrary PHP serialized payloads. This vulnerability could lead to remote code execution, compromising the integrity and confidentiality of the application. Organizations using affected versions should prioritize upgrading to version 3.0.1 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.