PT-2019-8296 · Automattic · Woocommerce

Published 2019-01-15 · Updated 2024-10-17 · CVE-2017-18356

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce plugin versions prior to 3.2.4

Description The issue allows an attack after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker constructs a specifically crafted string that turns into a PHP object injection involving the WC Shortcode Products::get products() function in the includes/shortcodes/class-wc-shortcode-products.php file, which uses cached queries within shortcodes.

Recommendations For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the WC Shortcode Products::get products() function until a patch is available. Additionally, limiting user privileges to below Shop manager may help minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-18356

Affected Products

Woocommerce

References · 6

• 🔥 https://blog.ripstech.com/2018/woocommerce-php-object-injection · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18356 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18356 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18356 · Note
• https://t.me/cvenotify/98445 · Telegram Post
• https://woocommerce.wordpress.com/2017/11/16/woocommerce-3-2-4-security-fix-release-notes · Note