CVE-2023-2843 MultiParcels Shipping For WooCommerce < 1.14.15 - Subscribers+ SQLi
Authenticated users can perform SQL injection attacks in the MultiParcels Shipping plugin due to improper parameter sanitization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2843?
CVE-2023-2843 is a high-severity SQL injection vulnerability in Unknown MultiParcels Shipping For WooCommerce, published on 7 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Which versions are affected by CVE-2023-2843?
It affects 1 product.
Products include Multiparcels Multiparcels Shipping for Woocommerce.
How do I fix CVE-2023-2843?
No fix has been published for CVE-2023-2843 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-2843 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2843 exists.
Other vulnerabilities in Unknown MultiParcels Shipping For WooCommerce
- CVE-2023-3365 MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion
- CVE-2023-3954 MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS
- CVE-2023-3671 MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS
- CVE-2023-3366 MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRF
Sources
Also known as GHSA-j9wp-57cc-qx5c.