PT-2024-36766 · Woocommerce · Dynamic Product Category Grid

João Pedro S Alcântara · Published 2024-12-31 · Updated 2025-01-05 · CVE-2024-56230

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dynamic Product Category Grid, Slider for WooCommerce versions 1.1.3 and earlier

Description The issue is related to improper control of filename for Include/Require Statement in PHP Program, allowing PHP Local File Inclusion. This problem can be exploited through the Inclusión de archivo remoto PHP or 'PHP Remote File Inclusion' vulnerability.

Recommendations For versions 1.1.3 and earlier, update to a version later than 1.1.3 to resolve the issue. As a temporary workaround, consider restricting access to vulnerable PHP files until a patch is available. Avoid using the vulnerable Include/Require statement in the affected PHP program until the issue is resolved.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-56230

Affected Products

Dynamic Product Category Grid

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-56230 · Security Note
• https://t.me/cvedetector/13980 · Telegram Post
• https://twitter.com/cracbot/status/1875784353953017989 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1874042864562249788 · Twitter Post
• https://twitter.com/CVEnew/status/1874036516021752127 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/dynamic-product-categories-design/vulnerability/wordpress-dynamic-product-category-grid-slider-for-woocommerce-plugin-1-1-3-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://t.me/latest_high_impact_cve/1734 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/dynamic-product-categories-design/vulnerability/wordpress-dynamic-product-category-grid-slider-for-woocommerce-plugin-1-1-3-local-file-inclusion-vulnerability?_s_id=cve · Note