PT-2024-32543 · WordPress · Shiftcontroller Employee Shift Scheduling
Peter Thaleikis
·
Published
2024-05-16
·
Updated
2024-07-09
·
CVE-2024-4733
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ShiftController Employee Shift Scheduling plugin versions up to, and including, 4.9.57
Description
The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the
hc3 session-cookie. This makes it possible for an authenticated attacker with contributor access-level or above to inject a PHP Object. No POP chain is present in the vulnerable plugin. However, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.Recommendations
For ShiftController Employee Shift Scheduling plugin versions up to, and including, 4.9.57, update to a version above 4.9.57 to mitigate the risk of PHP Object Injection. As a temporary workaround, consider restricting access to the
hc3 session-cookie to minimize the risk of exploitation. Additionally, restrict contributor access-level or above to trusted users only.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Shiftcontroller Employee Shift Scheduling