PT-2015-3660 · WordPress · Welcart E-Commerce

Publicado 2015-01-13 · Atualizado 2017-09-08 · CVE-2014-10016

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to purchase limit or the name, intl, nocod, or time parameter in an "add delivery method" action to "wp-admin/admin-ajax.php" API endpoint.

Recommendations For Welcart e-Commerce plugin version 1.3.12, consider disabling the "add delivery method" action in the "wp-admin/admin-ajax.php" API endpoint until a patch is available. Restrict access to the name, intl, nocod, and time parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-10016

Produtos afetados

Welcart E-Commerce

Referências · 6

• 🔥 http://packetstormsecurity.com/files/125513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10016 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91541 · Nota
• http://secunia.com/advisories/57222 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-10016 · Nota
• http://securityfocus.com/bid/65954 · Nota