CVE-2022-3536

🗓️ 07 Nov 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 68 Views🌐 WEB

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 allows authenticated users to perform PHAR deserialization attacks

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress plugin Role Based Pricing for WooCommerce 代码问题漏洞	7 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3536 Role Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR Deserialization	7 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-42902	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3536	7 Nov 202210:15	–	nvd
OSV	CVE-2022-3536	7 Nov 202210:15	–	osv
Patchstack	WordPress Role Based Pricing for WooCommerce premium plugin <= 1.6.2 - Auth. PHAR Deserialization vulnerability	17 Oct 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	7 Nov 202210:15	–	prion
Positive Technologies	PT-2022-22760 · WordPress · Role Based Pricing For Woocommerce	7 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3536	22 May 202523:04	–	redhatcve
Vulnrichment	CVE-2022-3536 Role Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR Deserialization	7 Nov 202200:00	–	vulnrichment

NVD

Vulners

Node

addify role_based_pricing_for_woocommerceRange<1.6.3wordpress

[
  {
    "vendor": "Unknown",
    "product": "Role Based Pricing for WooCommerce",
    "versions": [
      {
        "version": "1.6.3",
        "status": "affected",
        "lessThan": "1.6.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/6af63aab-b7a6-4ef6-8604-4b4b99467a34

Parameter	Position	Path	Description	CWE
file_path	request body	/wp-admin/admin-ajax.php?action=import_pricing_rules	PHAR deserialization via file upload without proper authorization/CSRF checks and with user-supplied path (file_path) enabling authenticated users to trigger gadget chain	CWE-502, CWE-352
afcsp_nonce	request body	/wp-admin/admin-ajax.php?action=import_pricing_rules	PHAR deserialization via file upload without proper authorization/CSRF checks and with user-supplied path (file_path) enabling authenticated users to trigger gadget chain	CWE-502, CWE-352
submit	request body	/wp-admin/admin-ajax.php?action=import_pricing_rules	PHAR deserialization via file upload without proper authorization/CSRF checks and with user-supplied path (file_path) enabling authenticated users to trigger gadget chain	CWE-502, CWE-352