Description

WordPress Plugin Instinct e-Commerce is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code on an affected computer with the privileges of the webserver process. The issue occurs because the application fails to sanitize user-supplied input. WordPress Plugin Instinct e-Commerce version 3.4 is vulnerable; other versions may also be affected.

Remediation

Update to the latest version

References

http://packetstormsecurity.com/files/view/71324/wpecomm-upload.txt

http://www.exploit-db.com/exploits/6867/

http://www.securityfocus.com/bid/31982/exploit

Related Vulnerabilities

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41165)

WordPress Plugin Cookie Notice & Consent Banner for GDPR & CCPA Compliance Cross-Site Scripting (1.7.1)

Internet Information Services Uncontrolled Resource Consumption Vulnerability (CVE-2009-2521)

Squid Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2213)

Omeka Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-26799)

Severity

High

Classification

CVE-2008-6811 CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Unauthenticated File Upload