CVE-2024-8353

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.

We have discovered 14,628 live websites that are affected by CVE-2024-8353.

Test my site



Affected Software

Product  GiveWP
Category Wordpress Plugins
Vulnerable Domains14,628 live websites (40.12% of GiveWP install base)
Vulnerable Versions
  • from 0 through 3.16.1
Vulnerable Versions Count216 versions ( 91.14% of all versions)


Common Weakness Enumeration

CWE-502 Deserialization of Untrusted Data



Details

  • Published - Sep 28, 2024
  • Updated - Sep 30, 2024

Credits

  • cuokon (finder)

CVE-2024-8353 usage by Country

United States7,561 websites


Germany1,421 websites
France762 websites
GB691 websites
Cyprus409 websites
Italy344 websites
Canada283 websites
Australia228 websites
Spain207 websites
South Africa174 websites

CVE-2024-8353 usage by TLD

.org6,114 websites
.com3,721 websites
.de360 websites
.it285 websites
.net252 websites
.ca237 websites
.org.uk228 websites
.fr213 websites
.co.uk190 websites
.nl126 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8353

Top websites that are affected by CVE-2024-8353. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.sk United States**,***
****.info United States**,***
*****.org United States**,***
********.org United States**,***
*********.org United States**,***
************.org United States**,***
****************.org Germany**,***
*******.org United States**,***
**************.com Australia**,***
****.org United States**,***
See full domain list

FAQ

CVE-2024-8353 is Deserialization of Untrusted Data in GiveWP
A total of 14,628 websites have been identified as vulnerable to CVE-2024-8353, discovered through global website indexing conducted by WebTechSurvey.
GiveWP is susceptible to CVE-2024-8353 vulnerability.
GiveWP versions before, and including, 3.16.1 are vulnerable to CVE-2024-8353.