CVE-2026-32271: Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Summary

A SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities:

SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks.

PDO Multi-Statement Queries -- PHP PDO MySQL enables CLIENTMULTISTATEMENTS by default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table.

Unrestricted unserialize() -- The yii2-queue PhpSerializer calls unserialize() with no allowedclasses restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object.

Gadget Chain (FileCookieJar) -- GuzzleHttp\Cookie\FileCookieJar (a standard Guzzle dependency) has an unguarded destruct() method that calls fileputcontents(). The attacker’s serialized payload writes a PHP webshell to the server’s webroot. PHP tags survive jsonencode() because Guzzle uses options=0 (no JSONHEXTAG).

The complete chain requires 3 HTTP requests and achieves arbitrary command execution as the PHP process user. Queue processing is triggered via GET /actions/queue/run, an endpoint that requires no authentication ($allowAnonymous = ['run']).

RCE Exploitation Steps

Authenticate as any control panel user POST to /admin/actions/dashboard/create-widget with stacked SQL injection: settings[type] contains the stacked INSERT with the serialized gadget chain Response: HTTP 500 (expected -- INSERT already committed) Trigger queue processing: GET /actions/queue/run Queue consumer deserializes the gadget chain FileCookieJar::destruct() writes webshell to webroot Access the webshell: GET /pocrce.php?c=id Response: uid=1000(home) gid=1000(home) groups=1000(home)