Lucene search

WPScanCVE-2021-24402

HistorySep 20, 2021 - 10:15 a.m.

CVE-2021-24402

2021-09-2010:15:08

CWE-89

WPScan

web.nvd.nist.gov

orders

wp icommerce

wordpress plugin

sql injection

security vulnerability

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

45.0%

JSON

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors

Affected configurations

Nvd

Vulners

Node

solvercirclewp_icommerceRange≤1.1.1wordpress

VendorProductVersionCPE
solvercirclewp_icommerce*cpe:2.3:a:solvercircle:wp_icommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
solvercircle	wp_icommerce	*	cpe:2.3:a:solvercircle:wp_icommerce::::::wordpress::*

CNA Affected

[
  {
    "product": "WP iCommerce – the first interactive ecommerce for wordpress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.1.1",
        "status": "affected",
        "version": "1.1.1",
        "versionType": "custom"
      }
    ]
  }
]

References

codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce/

wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

45.0%

JSON

Related for CVE-2021-24402