PT-2015-3660 · WordPress · Welcart E-Commerce

Published 2015-01-13 · Updated 2017-09-08 · CVE-2014-10016

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to purchase limit or the name, intl, nocod, or time parameter in an "add delivery method" action to "wp-admin/admin-ajax.php" API endpoint.

Recommendations For Welcart e-Commerce plugin version 1.3.12, consider disabling the "add delivery method" action in the "wp-admin/admin-ajax.php" API endpoint until a patch is available. Restrict access to the name, intl, nocod, and time parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-10016

Affected Products

Welcart E-Commerce

References · 6

• 🔥 http://packetstormsecurity.com/files/125513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10016 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91541 · Note
• http://secunia.com/advisories/57222 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-10016 · Note
• http://securityfocus.com/bid/65954 · Note