Welcart e-Commerce

Welcart through 2.12.1 lets an unauthenticated buyer store arbitrary reserve metadata during checkout, then select and unserialize it through the usces_action_acting_transaction Telecom EDY callback without provider, transaction, source-address, or ownership validation. Its bundled TCPDF library supplies a POP chain for arbitrary file deletion; when an administrator prints an invoice, deletion of wp-config.php can enable site reinstallation and code execution.

Welcart e-Commerce through 2.12.1 insufficiently sanitizes and escapes the custom_order value submitted through guest checkout. An unauthenticated attacker can store script in an order, and the payload executes when an administrator views that order in WordPress administration.

Welcart e-Commerce before 2.12.1 accepts a session identifier from an attacker-controlled request parameter and does not regenerate that identifier when the customer authenticates. An unauthenticated attacker can send a victim a crafted login request that fixes the shop session, then reuse the known identifier after the victim signs in to take over the customer's account.

Welcart e-Commerce is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.11.31.

Welcart e-Commerce before 2.11.33 accepts unauthenticated convenience-store and bank-transfer settlement notifications without proving they came from the payment provider. In the representative Epsilon path, EPSILON_SETTLEMENT::acting_transaction() accepts POST trans_code, user_id, order_number and paid; paid=1 resolves the attacker-supplied order through its stored settlement ID and passes it to usces_change_order_receipt() as receipted. An attacker who knows their own unpaid order number can therefore mark it paid and potentially obtain fulfilment without payment. Version 2.11.33 adds source-origin validation to provider notification paths. The reporter's exact targeted provider remains undisclosed until August 24.

Welcart e-Commerce before 2.11.34 lets an Author store script-bearing content in the product-name field exposed as itemName and getItemName(). Multiple product-facing output paths render the stored name without contextual escaping, so a visitor viewing the affected product executes the script. Version 2.11.34 applies esc_html(), esc_attr() and esc_js() at the remaining product-name sinks. The exact editor POST parameter and reporter's specific page template are not disclosed.

Welcart e-Commerce is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.11.28.

Welcart e-Commerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Welcart e-Commerce is affected by cross-site scripting. Exploitation requires an authenticated editor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Welcart e-Commerce is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Welcart e-Commerce is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Welcart e-Commerce is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Welcart e-Commerce is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Welcart e-Commerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Welcart e-Commerce is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Usc E Shop is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Usc E Shop is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Usc E Shop is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.