Paper/Archive/CVE-2023-5340

CVE-2023-5340

Unknown Five Star Restaurant Menu and Food Ordering — Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.3.693 × 2013.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

Affected

ProductAffectedFixed inSource

Five Star Restaurant Menu and Food Ordering< 2.4.112.4.11CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/91a5847a-62e7-4b98-a554-5eecb6a06e5b