CVE-2013-5977

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-5977
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html Exploit
http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
http://osvdb.org/98352
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Exploit
http://seclists.org/bugtraq/2013/Oct/52 Exploit
http://secunia.com/advisories/55265 Vendor Advisory
http://wordpress.org/plugins/cart66-lite/changelog/
http://www.exploit-db.com/exploits/28959 Exploit
http://www.securityfocus.com/bid/62975
https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html Exploit
http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
http://osvdb.org/98352
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Exploit
http://seclists.org/bugtraq/2013/Oct/52 Exploit
http://secunia.com/advisories/55265 Vendor Advisory
http://wordpress.org/plugins/cart66-lite/changelog/
http://www.exploit-db.com/exploits/28959 Exploit
http://www.securityfocus.com/bid/62975
https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cart66:cart66_lite_plugin:*:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.0.7:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.0.8:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.2:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.3:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.4:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.5:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.1.6:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.3.0:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.0:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.2:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.4:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.7:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.8:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.4.9:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.0.2:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.1:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.2:-:*:*:*:wordpress:*:*
cpe:2.3:a:cart66:cart66_lite_plugin:1.5.1.8:-:*:*:*:wordpress:*:*
History

21 Nov 2024, 01:58

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html - Exploit () http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html - Exploit
References () http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html - () http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html -
References () http://osvdb.org/98352 - () http://osvdb.org/98352 -
References () http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - Exploit () http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - Exploit
References () http://seclists.org/bugtraq/2013/Oct/52 - Exploit () http://seclists.org/bugtraq/2013/Oct/52 - Exploit
References () http://secunia.com/advisories/55265 - Vendor Advisory () http://secunia.com/advisories/55265 - Vendor Advisory
References () http://wordpress.org/plugins/cart66-lite/changelog/ - () http://wordpress.org/plugins/cart66-lite/changelog/ -
References () http://www.exploit-db.com/exploits/28959 - Exploit () http://www.exploit-db.com/exploits/28959 - Exploit
References () http://www.securityfocus.com/bid/62975 - () http://www.securityfocus.com/bid/62975 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/87874 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/87874 -
Information

Published : 2013-11-01 15:55

Updated : 2025-04-11 00:51

NVD link : CVE-2013-5977

Mitre link : CVE-2013-5977

CVE.ORG link : CVE-2013-5977

JSON object : View

Products Affected

cart66

  • cart66_lite_plugin
CWE
CWE-352

Cross-Site Request Forgery (CSRF)