Lucene search
PRIOn knowledge basePRION:CVE-2017-18356HistoryJan 15, 2019 - 4:29 p.m.
Design/Logic Flaw
2019-01-1516:29:00
PRIOn knowledge base
www.prio-n.com
1
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes.
| CPE | Name | Operator | Version |
|---|---|---|---|
| woocommerce | lt | 3.2.4 |
Related
openvas
openvas
WordPress WooCommerce Plugin Privilege Escalation Vulnerability - Windows
2019-01-16 00:00:00
WordPress WooCommerce Plugin < 3.2.4 Privilege Escalation Vulnerability
2019-01-16 00:00:00
cve
cve
CVE-2017-18356
2019-01-15 16:29:00
wpvulndb
wpvulndb
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
2017-11-16 00:00:00
veracode
veracode
Object Injection
2019-01-16 07:09:47
nvd
nvd
CVE-2017-18356
2019-01-15 16:29:00
osv
osv
CVE-2017-18356
2019-01-15 16:29:00
cvelist
cvelist
CVE-2017-18356
2019-01-15 16:00:00