CVE-2013-5977

Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html	Exploit
http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
http://osvdb.org/98352
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html	Exploit
http://seclists.org/bugtraq/2013/Oct/52	Exploit
http://secunia.com/advisories/55265	Vendor Advisory
http://wordpress.org/plugins/cart66-lite/changelog/
http://www.exploit-db.com/exploits/28959	Exploit
http://www.securityfocus.com/bid/62975
https://exchange.xforce.ibmcloud.com/vulnerabilities/87874

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cart66:cart66_lite_plugin::-::::wordpress::
	cpe:2.3:a:cart66:cart66_lite_plugin:1.0.7:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.0.8:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.2:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.3:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.4:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.5:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.1.6:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.3.0:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.0:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.2:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.4:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.7:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.8:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.4.9:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0.2:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.1:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.2:-::::wordpress::*
	cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.8:-::::wordpress::*

History

07 Nov 2023, 02:16

Type	Values Removed	Values Added
References	{'url': 'http://blog.noobroot.com/#!/2013/10/0-day-wordpress-cart66-plugin-15114.html', 'name': 'http://blog.noobroot.com/#!/2013/10/0-day-wordpress-cart66-plugin-15114.html', 'tags': [], 'refsource': 'MISC'}	() http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html -

Information

Published : 2013-11-01 15:55

Updated : 2024-02-28 12:00

NVD link : CVE-2013-5977

Mitre link : CVE-2013-5977

CVE.ORG link : CVE-2013-5977

JSON object : View

Products Affected

cart66

cart66_lite_plugin

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

6.8 /10