by Kastro
Paper/Archive/CVE-2023-0232

CVE-2023-0232

Unknown ShopLentor — ShopLentor < 2.5.4 - PHP Object Injection

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.6.886 × 2017.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.

Affected

ProductAffectedFixed inSource
ShopLentor< 2.5.42.5.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518patchplugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php