Printcart Storeに遠隔コード実行の脆弱性、修正版は要確認
Summary
WordPressプラグインのPrintcart Store 2.13.2以前に、ログイン不要でサーバー上へPHPファイルを置かれ、遠隔からコードを実行される脆弱性が公表されました。まず導入の有無と、アップロード画面の設定が Advanced Upload Popup かどうかを確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressプラグインのPrintcart Store 2.13.2以前に、ログイン不要でサーバー上へPHPファイルを置かれ、遠隔からコードを実行される脆弱性が公表されました。まず導入の有無と、アップロード画面の設定が Advanced Upload Popup かどうかを確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| printcartPrintcart Store – Web to Print Product Designer for WooCommerce |
≤ 2.13.2→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the nbu_crop_image AJAX handler accepting a user-supplied url parameter that Nbdesigner_IO::convert_url_to_path() concatenates onto the uploads base directory without normalizing or stripping ../ sequences, and then deriving both the output directory and output file extension via pathinfo() from the same attacker-controlled path — with no stripImage() call before writeImage() is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the nbdesigner_upload_popup_style site option is set to a (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required save-design nonce is printed on the fully public frontend upload-design-file page, making it trivially obtainable by any anonymous visitor once that configuration is active.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory