CVE-2024-10828 Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details
Unauthenticated attackers can achieve remote code execution via PHP object injection in the Advanced Order Export plugin when a specific option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10828?
CVE-2024-10828 is a high-severity unsafe deserialization vulnerability in algolplus Advanced Order Export For WooCommerce, published on 13 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Weakness: CWE-502
Which versions are affected by CVE-2024-10828?
It affects 1 product.
Products include Algolplus Advanced Order Export for Woocommerce.
How do I fix CVE-2024-10828?
No fix has been published for CVE-2024-10828 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-10828 being exploited?
There is no known exploitation of CVE-2024-10828 in the wild and no public exploit code.
Other vulnerabilities in algolplus Advanced Order Export For WooCommerce
- CVE-2018-11525 Code injection in n/a
- CVE-2021-24169 Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
- CVE-2021-27349 Cross-site scripting in n/a
- CVE-2020-11727 Cross-site scripting in n/a
- CVE-2022-35275 Cross-site scripting in Advanced Order Export For WooCommerce (WordPress plugin)
Sources
Also known as GHSA-6439-mj9p-x34m.