CVE-2021-32789

HIGHNuclei

Arbitrary SQL (SQL injection) possible via the Store API component.

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-32789 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 23, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2
Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

woocommerce_blocks

Browse automattic / woocommerce_blocks
VulnCheckVersion data not supplied

woocommerce-gutenberg-products-block

Browse woocommerce / woocommerce-gutenberg-products-block
CVE List> 2.5.0, < 2.5.16affected

Proofs of concept

2

Repository PoCs

GitHuband0x00/CVE-2021-32789Repository PoCby and0x001Not analyzed2 files

3.2 KiB

GitHub
PoC details
GitHubDonVorrin/CVE-2021-32789Repository PoCby DonVorrin0Not analyzed3 files

4.9 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHWooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL InjectionCVSS 7.5

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the affected system.

Remediation

Update WooCommerce Blocks to version 5.6 or later to mitigate the vulnerability.

WeaknessesCWE-89
Authorsrootxharsh, iamnoooob, S1r1u5_, cookiehanhoan, madrobot
Template tagscve2021cvewordpresswoocommercesqliwp-pluginwpwpscanautomatticvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:*
https://woocommerce.com/posts/critical-vulnerability-detected-july-2021 https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx https://securitynews.sonicwall.com/xmlpost/wordpress-woocommerce-plugin-sql-injection/ https://wpscan.com/vulnerability/0f2089dc-9376-4d7d-95a2-25c99526804a https://nvd.nist.gov/vuln/detail/CVE-2021-32789

Source: ProjectDiscovery

References

5