The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2024-01-08T19:00:32.181Z
Updated: 2024-08-02T08:14:25.192Z
Reserved: 2023-11-03T17:40:53.323Z
Link: CVE-2023-5957
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2024-01-08T19:15:09.890
Modified: 2024-01-11T19:44:55.317
Link: CVE-2023-5957
Redhat
No data.