PT-2019-13909 · Woocommerce · Woocommerce Paypal Checkout Payment Gateway

Heibie · Published 2019-08-29 · Updated 2024-08-05 · CVE-2019-14979

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce PayPal Checkout Payment Gateway plugin version 1.6.17

Description The issue allows for parameter tampering in the amount parameter, such as amount 1, in the cgi-bin/webscr?cmd= cart endpoint. This can be exploited to purchase an item for a lower price than intended. However, the amount is validated against the WooCommerce order total before completing the order. If the amounts do not match, the order will be left in an "On Hold" state.

Recommendations For WooCommerce PayPal Checkout Payment Gateway plugin version 1.6.17, consider validating user input for the amount 1 parameter to prevent tampering, and ensure that the amount is consistent with the WooCommerce order total before completing the order. As a temporary workaround, monitor orders left in an "On Hold" state for potential exploitation attempts.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-14979

Affected Products

Woocommerce Paypal Checkout Payment Gateway

References · 4

• 🔥 https://gkaim.com/cve-2019-14979-vikas-chaudhary · Exploit
• https://osv.dev/vulnerability/CVE-2019-14979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14979 · Security Note
• https://wordpress.org/support/topic/vulnerabilty-in-plugin/#post-11899173 · Note