PT-2023-16100 · WordPress · Shoplentor

Publicado 2023-02-21 · Atualizado 2025-03-12 · CVE-2023-0232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShopLentor WordPress plugin versions prior to 2.5.4

Description The issue arises from the plugin unserializing user input from cookies to track viewed products and user data, potentially leading to PHP Object Injection. This could allow an attacker to inject malicious PHP objects, compromising the security of the system.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider disabling the tracking of viewed products and user data via cookies until the update is applied. Restrict access to sensitive data and functions that may be exploited through PHP Object Injection to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2023-0232

Produtos afetados

Shoplentor

Referências · 7

• 🔥 https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518 · Exploit
• https://t.me/cvenotify/114536 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0232 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0232 · Nota de Segurança
• https://t.me/cvenotify/44723 · Publicação no Telegram
• https://t.me/cibsecurity/58579 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php · Correção