CVE-2015-3300

Vulnerability

TheCartPress eCommerce Shopping Cart plugin for WordPress (versions before 1.3.9.3) contains multiple stored cross-site scripting (XSS) vulnerabilities. The plugin fails to sanitize user-supplied input passed via numerous parameters in the checkout process and various admin pages. Specifically, the following parameters are affected: billing_firstname, billing_lastname, billing_company, billing_tax_id_number, billing_city, billing_street, billing_street_2, billing_postcode, billing_telephone_1, billing_telephone_2, billing_fax, shipping_firstname, shipping_lastname, shipping_company, shipping_tax_id_number, shipping_city, shipping_street, shipping_street_2, shipping_postcode, shipping_telephone_1, shipping_telephone_2, shipping_fax in shopping-cart/checkout/; search_by in admin/AddressesList.php; address_id, address_name, firstname, lastname, street, city, postcode, email in admin/AddressEdit.php; post_id, rel_type in admin/AssignedCategoriesList.php; and post_type in admin/CustomFieldsList.php. An attacker can inject arbitrary web script or HTML that is stored and later executed in the context of the victim's browser. [1]

Exploitation

An attacker does not need authentication to exploit the checkout parameters, as they are part of the public checkout form. For admin page parameters, the attacker would need to trick an authenticated administrator into submitting crafted input, possibly via a CSRF attack. The attacker can simply submit a malicious payload in any of the listed fields. The injected script is stored on the server and executed when an administrator or other user views the affected page (e.g., order details or address lists). [1]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the WordPress admin or frontend, leading to session hijacking, defacement, or theft of sensitive information such as cookies and authentication tokens. The impact is limited to the privileges of the victim user; however, if an administrator is targeted, the attacker could potentially gain full control of the WordPress installation. [1]

Mitigation

The vulnerability was fixed in version 1.3.9.3 of the plugin. However, as of October 5, 2021, the plugin has been closed and removed from the WordPress.org plugin directory due to a security issue, and no patched version is available for download. Users who have the plugin installed should uninstall it immediately and migrate to an alternative eCommerce solution. [2][3]