// For flags

CVE-2023-5340

Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

El complemento Five Star Restaurant Menu and Food Ordering de WordPress anterior a 2.4.11 deserializa la entrada del usuario a través de una acción AJAX disponible para usuarios no autenticados, lo que les permite realizar inyección de objetos PHP cuando hay un gadget adecuado presente en el blog.

The Five Star Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.10 via deserialization of untrusted input from the 'options' parameter supplied via the 'fdm_update_cart_item' AJAX action. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

*Credits: Krzysztof Zając (CERT PL), WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-10-02 CVE Reserved
  • 2023-10-27 CVE Published
  • 2024-11-21 CVE Updated
  • 2024-11-21 First Exploit
  • 2024-12-22 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fivestarplugins
Search vendor "Fivestarplugins"
 Five Star Restaurant Menu
Search vendor "Fivestarplugins" for product "Five Star Restaurant Menu"
 < 2.4.11
Search vendor "Fivestarplugins" for product "Five Star Restaurant Menu" and version " < 2.4.11"
wordpress
Affected