PT-2021-15935 · WordPress · Wp Ecommerce

Syed Sheeraz Ali · Published 2021-09-20 · Updated 2021-09-29 · CVE-2021-24402

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP iCommerce WordPress plugin versions 1.1.1 and earlier

Description The Orders functionality in the WP iCommerce WordPress plugin has an order id parameter that is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection. This feature is available to low-privilege users, such as contributors.

Recommendations For WP iCommerce WordPress plugin versions 1.1.1 and earlier, consider disabling the Orders functionality until a patch is available to prevent SQL injection attacks. Restrict access to the Orders feature to minimize the risk of exploitation, especially for low-privilege users. Avoid using the order id parameter in the affected SQL statement until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24402

Affected Products

Wp Ecommerce

References · 6

• 🔥 https://wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707 · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce · Exploit
• https://osv.dev/vulnerability/CVE-2021-24402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24402 · Security Note
• https://t.me/cibsecurity/29091 · Telegram Post
• https://t.me/cvenotify/21627 · Telegram Post