Reliance on untrusted inputs (CWE-807), insufficient data verification and lack of any cryptographic authentication (hmac etc) at IPN callback allow remote (even unauthorized) attacker to bypass payment process and spoof real order status without actually paying for it.
CVE-2018-20782
Reliance on untrusted inputs (CWE-807), insufficient data verification and lack of any cryptographic authentication (hmac etc) at IPN callback allow remote (even unauthorized) attacker to bypass payment process and spoof real order status without actually paying for it.
Vulnerable code (fixed in PR #2)
woocommerce-payment-api-plugin/src/Gateway.php
Lines 374 to 511 in 8c254d6
Affected versions: ≤ 1.1.1
Tested on: WordPress 4.9.9 + WooCommerce 3.5.1 + GloBee Payment Gateway Plugin 1.1.1
Proof-of-Concept
PoC (php): exploit-db.com/exploits/46414PoC (shell):
The text was updated successfully, but these errors were encountered: