CVE-2017-18356
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes.
En el plugin Automattic WooCommerce en versiones anteriores a la 3.2.4 para WordPress, es posible realizar un ataque tras obtener acceso al sitio objetivo con una cuenta de usuario que tiene, al menos, privilegios de gerente de tienda. El atacante construye una cadena especialmente manipulada que se convertirá en una inyección de objetos PHP relacionada con el uso de consultas en caché en códigos cortos en WC_Shortcode_Products::get_products(), en includes/shortcodes/class-wc-shortcode-products.php.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-16 CVE Published
- 2019-01-15 CVE Reserved
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://woocommerce.wordpress.com/2017/11/16/woocommerce-3-2-4-security-fix-release-notes | Release Notes |
URL | Date | SRC |
---|---|---|
https://blog.ripstech.com/2018/woocommerce-php-object-injection | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Automattic Search vendor "Automattic" | Woocommerce Search vendor "Automattic" for product "Woocommerce" | < 3.2.4 Search vendor "Automattic" for product "Woocommerce" and version " < 3.2.4" | wordpress |
Affected
|