PT-2019-13982 · Webtoffee · Webtoffee Wordpress Users & Woocommerce Customers Import Export

Publicado 2019-08-22 · Atualizado 2020-08-24 · CVE-2019-15092

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webtoffee WordPress Users & WooCommerce Customers Import Export plugin version 1.3.0

Description The issue allows CSV injection in the user url, display name, first name, and last name columns in an exported CSV file created by the WF CustomerImpExpCsv Exporter class.

Recommendations For version 1.3.0, consider avoiding the use of the WF CustomerImpExpCsv Exporter class until a patch is available. As a temporary workaround, restrict the export functionality to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

CVE-2019-15092

Produtos afetados

Webtoffee Wordpress Users & Woocommerce Customers Import Export

Referências · 8

• 🔥 https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection · Exploit
• 🔥 https://exploit-db.com/exploits/47303 · Exploit
• 🔥 http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-Users-1.3.1-CSV-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15092 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15092 · Aviso do Fabricante
• https://wpvulndb.com/vulnerabilities/9704 · Nota
• https://t.me/rnetsec/10252 · Publicação no Telegram
• https://t.me/defcon_news/22468 · Publicação no Telegram