WP EasyCart Plugin up to 3.0.20 on WordPress admin_ajax_functions.php ec_ajax_update_option/ec_ajax_clear_all_taxrates option_name/option_value access control

Summaryinfo

A vulnerability, which was classified as critical, was found in WP EasyCart Plugin up to 3.0.20 on WordPress. The affected element is the function ec_ajax_update_option/ec_ajax_clear_all_taxrates of the file inc/admin/admin_ajax_functions.php. Such manipulation of the argument option_name/option_value as part of Parameter leads to access control. This vulnerability is traded as CVE-2015-2673. The attack may be launched remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability was found in WP EasyCart Plugin up to 3.0.20 on WordPress (WordPress Plugin) and classified as critical. Affected by this issue is the function ec_ajax_update_option/ec_ajax_clear_all_taxrates of the file inc/admin/admin_ajax_functions.php. The manipulation of the argument option_name/option_value as part of a Parameter leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for Wordpress allows remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.

The bug was discovered 02/25/2015. The weakness was shared 10/06/2017 (Website). The advisory is shared for download at blog.rastating.com. This vulnerability is handled as CVE-2015-2673 since 03/23/2015. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068.

The exploit is available at packetstormsecurity.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 954 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:inc/admin/admin_ajax_functions.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• WP EasyCart Plugin

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion