Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

highseverity

7.2CVSS score

1.4%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.

Impact

This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

Fix

Fixed in 5.2.0

How to confirm it

Send: GET /wp-content/plugins/woocommerce-abandoned-cart/readme.txt
Positive when: compare_versions(version, "< 5.2.0") and contains(body, "Abandoned Cart") and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-25152 -u <target>

The full check

id: CVE-2019-25152

info:
  name: Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: high
  description: |
    The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.
  impact: |
    This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
  remediation: Fixed in 5.2.0
  reference:
    - https://wpscan.com/vulnerability/915420b1-f476-481e-9b11-b736a7cfdda7/
    - https://wpscan.com/vulnerability/9229
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25152
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2019-25152
    epss-score: 0.01353
    epss-percentile: 0.71799
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tychesoftwares
    product: abandoned_cart_lite_for_woocommerce
    framework: wordpress
    fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
    shodan-query: http.html:"/wp-content/plugins/woocommerce-abandoned-cart/"
  tags: cve,cve2019,wpscan,wordpress,wp,wp-plugin,woocommerce-abandoned-cart,xss,passive,vkev,vuln

http:
  - raw:
      - |
        GET /wp-content/plugins/woocommerce-abandoned-cart/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "< 5.2.0")'
          - 'contains(body, "Abandoned Cart")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?mi)Stable tag: ([0-9.]+)"
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from