20131011 Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilitiesmailing list
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html CVE-2013-5977
WordPress Plugin Cart66 1.5.1.14 - Multiple Vulnerabilities
Record summary
CVE-2013-5977 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBWordPress Plugin Cart66 1.5.1.14 - Multiple VulnerabilitiesExploitDB exploitby absaneNot analyzed1 file
References
11blog.noobroot.com
http://blog.noobroot.com/ 98352vdb entry
http://osvdb.org/98352 packetstormsecurity.com
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 20131014 Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilitiesmailing list
http://seclists.org/bugtraq/2013/Oct/52 55265Third-party advisory
http://secunia.com/advisories/55265 wordpress.orgConfirmation
http://wordpress.org/plugins/cart66-lite/changelog 28959exploit
http://www.exploit-db.com/exploits/28959 62975vdb entry
http://www.securityfocus.com/bid/62975 wp-cart66-cve20135977-admin-csrf(87874)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87874 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2013-5977