CVSS: 8.8EPSS: 0%CPEs: 23EXPL: 0CVE-2021-32790 – Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint
https://notcve.org/view.php?id=CVE-2021-32790
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. • https://github.com/woocommerce/woocommerce/security/advisories/GHSA-7vx5-x39w-q24g https://woocommerce.com/posts/critical-vulnerability-detected-july-2021 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24323 – Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24323
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled Cuando la opción taxes está habilitada, el campo "Additional tax classes" no es saneado apropiadamente antes de ser devuelto en el panel de administración, permitiendo a usuarios con altos privilegios, tales como el administrador, usar cargas útiles XSS incluso cuando el parámetro unfiltered_html está deshabilitado The WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Additional tax classes' field when the tax functionality of WooCommerce is enabled in versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24212 – WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE
https://notcve.org/view.php?id=CVE-2021-24212
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp. El plugin del WordPress WooCommerce Help Scout, versiones anteriores a 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) permite a usuarios no autenticados cargar cualquier archivo en el sitio que, por defecto, terminará en wp-content/uploads/hstmp • http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24171 – WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2021-24171
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter. El plugin de WordPress WooCommerce Upload Files versiones anteriores a 59.4 ejecutó una sola pasada de saneamiento para eliminar extensiones bloqueadas como .php. Era posible omitir esto y cargar un archivo con una extensión PHP insertando una extensión "blocked" dentro de otra extensión "blocked" en el parámetro "wcuf_file_name". • https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194 https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35627
https://notcve.org/view.php?id=CVE-2020-35627
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server. Ultimate WooCommerce Gift Cards versión 3.0.2, está afectada por una vulnerabilidad de carga de archivos en la Custom GiftCard Template que puede ejecutar remotamente código arbitrario. Una vez que contiene la función "Custom Gift Card Template", la función de cargar una imagen personalizada es usada, cambiando el nombre de la extensión de la imagen a PHP y ejecutando el código PHP en el servidor • https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6 https://makewebbetter.com/product/giftware-woocommerce-gift-cards • CWE-434: Unrestricted Upload of File with Dangerous Type •