Яндекс Доставка (Boxberry) Security & Risk Analysis

The Boxberry plugin v2.34 exhibits a concerning security posture, largely due to a significant number of unprotected AJAX handlers. While the plugin demonstrates good practices in other areas, such as a high percentage of prepared SQL statements and properly escaped output, the presence of 7 unprotected AJAX entry points creates a substantial attack surface. The static analysis also flags the use of the dangerous `unserialize` function, which, if combined with user-controlled input, could lead to serious vulnerabilities like Remote Code Execution. The vulnerability history, with one unpatched medium severity CVE related to missing authorization, further highlights this weakness and suggests a recurring issue with access control. Although there are no critical or high severity taint flows identified, the combination of unprotected entry points, the dangerous function, and past authorization issues warrants significant caution.