WP eCommerce WordPress Plugin Unauthenticated PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the WP eCommerce WordPress plugin, affecting versions through 3.15.1. The issue arises because the plugin unserializes user input via AJAX actions, which could enable unauthenticated users to perform object injection when a suitable gadget is available on the blog.

Impact

Exploitation of this vulnerability allows for PHP Object Injection, which could lead to arbitrary code execution or other malicious actions, depending on the injected object and the application's context.

Reproduction

To reproduce this vulnerability, send a POST request to '/wp-admin/admin-ajax.php' with the 'action' parameter set to 'wpsc_update_customer_meta'. Include a malicious serialized payload in the 'meta_value' parameter. After injecting the payload, verify its persistence by requesting the same meta key, which should return the injected data, indicating successful exploitation.