Lucene search
PRIOn knowledge basePRION:CVE-2022-4237HistoryJan 02, 2023 - 10:15 p.m.
Design/Logic Flaw
2023-01-0222:15:00
PRIOn knowledge base
www.prio-n.com
3
welcart e-commerce
wordpress plugin
logic flaw
user input validation
file existence
ajax
authenticated users
subscriber role
phar deserialization
file upload
gadget chain
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
| CPE | Name | Operator | Version |
|---|---|---|---|
| welcart_e-commerce | lt | 2.8.6 |
Related
cvelist
cvelist
CVE-2022-4237 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation
2023-01-02 21:49:40
wpexploit
wpexploit
Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation
2022-12-05 00:00:00
wpvulndb
wpvulndb
Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation
2022-12-05 00:00:00
cve
cve
CVE-2022-4237
2023-01-02 22:15:16
nvd
nvd
CVE-2022-4237
2023-01-02 22:15:16