6.8

CVE-2013-5977

Exploit

Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Mögliche Gegenmaßnahme
Cart66 Lite :: WordPress Ecommerce: Update to version 1.5.1.15, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cart66 ≫ Cart66 Lite Plugin Update- SwPlatformwordpress Version <= 1.5.1.14
Cart66 ≫ Cart66 Lite Plugin Version1.0.7 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.0.8 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.3 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.4 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.5 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.6 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.3.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.4 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.7 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.8 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.9 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.8 Update- SwPlatformwordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Cart66 Lite :: WordPress Ecommerce
Version [*, 1.5.1.15)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.15% 0.863
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html
Exploit
http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
http://osvdb.org/98352
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
Exploit
http://seclists.org/bugtraq/2013/Oct/52
Exploit
http://secunia.com/advisories/55265
Vendor Advisory
http://wordpress.org/plugins/cart66-lite/changelog/
http://www.exploit-db.com/exploits/28959
Exploit
http://www.securityfocus.com/bid/62975
https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
https://www.wordfence.com/threat-intel/vulnerabilities/id/20de9544-b2fe-470c-a7a4-b662b59d6d31
Third Party Advisory