Vulnerabilities > CVE-2019-7441 - Unspecified vulnerability in Woocommerce Paypal Checkout Payment Gateway 1.6.8

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
woocommerce
exploit available
NVD
Published: 2019-03-21
Updated: 2024-11-21

Summary

cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state

Vulnerable Configurations

Part Description Count
Application
Woocommerce
1

Exploit-Db

fileexploits/php/webapps/46632.txt
idEDB-ID:46632
last seen2019-04-02
modified2019-04-02
platformphp
port
published2019-04-02
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/46632
titleWordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering
typewebapps

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/152362/wpppcpg168-tamper.txt
idPACKETSTORM:152362
last seen2019-04-05
published2019-04-02
reporterVikas Chaudhary
sourcehttps://packetstormsecurity.com/files/152362/WordPress-PayPal-Checkout-Payment-Gateway-1.6.8-Parameter-Tampering.html
titleWordPress PayPal Checkout Payment Gateway 1.6.8 Parameter Tampering

References