CVE-2013-5977 Cross-site request forgery in n/a
Remote attackers can hijack administrator sessions to create or modify products and inject XSS via CSRF in the Cart66 Lite plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-5977?
CVE-2013-5977 is a medium-severity vulnerability in n/a, published on 1 Nov 2013. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Weakness: CWE-352
Which versions are affected by CVE-2013-5977?
It affects 1 product.
Products include Cart66 Cart66 Lite Plugin.
How do I fix CVE-2013-5977?
No fix has been published for CVE-2013-5977 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-5977 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-5977 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rjff-hcjj-9m74.