Vulnerability Details : CVE-2022-4237

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog

Published 2023-01-02 22:15:17

Updated 2023-01-09 19:14:47

Source WPScan

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-4237

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 17 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-4237

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-4237

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigned by: [email protected] (Primary)

References for CVE-2022-4237

https://wpscan.com/vulnerability/7a4b790c-49ae-46bc-9544-e188deae243f

Exploit;Third Party Advisory

Products affected by CVE-2022-4237

Collne » Welcart E-commerce » For Wordpress
Versions before (<) 2.8.6
cpe:2.3:a:collne:welcart_e-commerce:*:*:*:*:*:wordpress:*:*
Matching versions