CVE-2021-32789 Arbitrary SQL (SQL injection) possible via the Store API component.

2021-07-2615:30:12

CWE-89

GitHub_M

www.cve.org

arbitrary sql injection

woocommerce-gutenberg-products-block

store api

sql injection vulnerability

woocommerce

version 2.5.0

version 2.5.16

url exploit

read only sql query

patch

upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.105

Percentile

95.1%

JSON

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the wc/store/products/collection-data?calculate_attribute_counts[][taxonomy] endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

CNA Affected

[
  {
    "product": "woocommerce-gutenberg-products-block",
    "vendor": "woocommerce",
    "versions": [
      {
        "status": "affected",
        "version": "> 2.5.0, < 2.5.16"
      }
    ]
  }
]