PT-2024-17540 · WordPress · Print Science Designer

Brian Sans-Souci + 1 · Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-12312

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Print Science Designer plugin for WordPress versions up to, and including, 1.3.152

Description The issue concerns a PHP Object Injection vulnerability in the Print Science Designer plugin for WordPress. This vulnerability arises from the deserialization of untrusted input through the designer-saved-projects cookie, allowing unauthenticated attackers to inject a PHP object. There is no known POP chain present in the vulnerable software. However, if a POP chain is present via an additional plugin or theme installed on the target system, it could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations For versions up to, and including, 1.3.152, update to a version later than 1.3.152 to resolve the issue. As a temporary workaround, consider restricting access to the designer-saved-projects cookie to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-12312

Affected Products

Print Science Designer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-12312 · Security Note
• https://twitter.com/CVEnew/status/1867171858585383365 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8008b5e2-f3b4-492c-8e50-b673f725b2b1?source=cve · Note
• https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.152/includes/saved-projects.php#L120 · Note
• https://t.me/cvedetector/12746 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1867186165318582742 · Twitter Post
• https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.153/includes/saved-projects.php#L120 · Note
• https://t.me/latest_high_impact_cve/1638 · Telegram Post