Description
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | E-cab Taxi Booking Manager for Woocommerce | 2.0.1 – < 2.0.5 | 2.0.5 |
References
- https://wpscan.com/vulnerability/241a7890-81b3-4685-a243-e774d560f17a/ exploit vdb-entry technical-description