SQL Injection Affecting woocommerce/woocommerce package, versions >=5.5.0, <5.5.2 >=5.4.0, <5.4.2 >=5.3.0, <5.3.1 >=5.2.0, <5.2.3 >=5.1.0, <5.1.1 >=5.0.0, <5.0.1 >=4.9.0, <4.9.3 >=4.8.0, <4.8.1 >=4.7.0, <4.7.2 >=4.6.0, <4.6.3 >=4.5.0, <4.5.3 >=4.4.0, <4.4.2 >=4.3.0, <4.3.4 >=4.2.0, <4.2.3 >=4.1.0, <4.1.2 >=4.0.0, <4.0.2 >=3.9.0, <3.9.4 >=3.8.0, <3.8.2 >=3.7.0, <3.7.2 >=3.6.0, <3.6.6 >=3.5.0, <3.5.9 >=3.4.0, <3.4.8 <3.3.6
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-WOOCOMMERCEWOOCOMMERCE-1533590
- published 27 Jul 2021
- disclosed 27 Jul 2021
- credit Unknown
Introduced: 27 Jul 2021
CVE-2021-32790 Open this link in a new tabHow to fix?
Upgrade woocommerce/woocommerce
to version 5.5.2, 5.4.2, 5.3.1, 5.2.3, 5.1.1, 5.0.1, 4.9.3, 4.8.1, 4.7.2, 4.6.3, 4.5.3, 4.4.2, 4.3.4, 4.2.3, 4.1.2, 4.0.2, 3.9.4, 3.8.2, 3.7.2, 3.6.6, 3.5.9, 3.4.8, 3.3.6 or higher.
Overview
woocommerce/woocommerce is an eCommerce toolkit that helps you sell anything.
Affected versions of this package are vulnerable to SQL Injection. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of /wp-json/wc/v3/webhooks
, /wp-json/wc/v2/webhooks
and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting search
parameter information can be disclosed using timing and related attacks.