# CVE-2022-24108: CVE-2022-24108

- Exploited (CISA KEV): no
- Published: 2022-05-17
- CVSS: not scored
- EPSS: 32.6% (98th percentile)

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-04-02 | 1051 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Before feed history | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### Cloudflare

- 2025-04-02 · new · rule 0d838d9ab046443fa3f8b3e50c99546a · default Block
  > Command Injection - CVE:CVE-2022-24108. Previous action: N/A. New action: Block. N/A
  Source: https://developers.cloudflare.com/changelog/post/2025-04-02-waf-release/

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2022-24108 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2022-24108