Adhikara13

The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue occurs because the `order by` parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with custom-level access or higher can append malicious SQL queries to extract sensitive information from the database.

The DT LMS – elearning WordPress plugin allows unauthenticated attackers to modify arbitrary plugin option values in the `wp options` table. This is caused by a missing capability check and lack of nonce verification in multiple AJAX handlers, including `dtlms save poc settings`, `dtlms save skin settings`, and `dtlms save options settings`. These handlers are registered on the `wp ajax nopriv *` hook and pass user-supplied data directly to the `update option()` function. An attacker can exploit this to overwrite Point-of-Contact email configurations and skin or branding settings, altering the appearance and behavior of the LMS for all visitors.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts into pages via custom field parameters. These scripts execute when a user accesses the affected page. The `booked add appt` AJAX action is protected by a nonce (a unique token used to prevent replay attacks) that is publicly embedded on any page rendering the booking calendar shortcode, allowing unauthenticated users to obtain it easily.

توجد ثغرة تتعلق بتزوير الطلبات عبر المواقع (CSRF) دون مصادقة، مما قد يؤدي إلى حدوث هجوم «التنفيذ البرمجي عبر المواقع المخزّن» (Stored XSS). CSRF هي ثغرة تسمح للمهاجم بخداع الضحية لتنفيذ إجراءات لم تكن تنوي القيام بها، بينما يحدث XSS المخزن عندما يتم تخزين برنامج نصي ضار بشكل دائم على الخادم المستهدف وتنفيذه في متصفح المستخدمين الذين يزورون الصفحة المتأثرة.

من الممكن حدوث وصول غير مصرح به بسبب عدم وجود فحص للصلاحيات في الدالة `activate plugin()`. وهذا يسمح للمستخدمين المصادق عليهم الذين يتمتعون بأذونات على مستوى «المشترك» أو أعلى بتنشيط مجموعة محدودة من المكونات الإضافية.

ثغرة في التحكم في الوصول دون مصادقة تسمح للمهاجم بتجاوز قيود التفويض دون تقديم بيانات اعتماد صالحة.

The issue is a buffer overflow that can be triggered via the `pingWdogIp`. This allows attackers to cause a Denial of Service (DoS) by providing a crafted input.

A command injection issue was discovered via the `ddnsDomainName` parameter in the Dynamic DNS settings. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

A command injection issue was discovered in the Wake-On-LAN (WoL) function via the `wakeup mac` parameter. This issue can be exploited using a crafted payload.

The issue is related to a command injection vulnerability. This vulnerability can be exploited via a crafted payload, specifically through the `Hostname` parameter within the WAN settings.

The issue is related to a command injection vulnerability in the Changing Username and Password function. This vulnerability can be exploited via a crafted payload.

A command injection issue was discovered in the diagnostic tools page of the affected software. This issue can be exploited through a crafted HTTP request.

An issue in the diagnostic tools component of the admin management interface allows a remote attacker to execute arbitrary code via the `ping` and `traceroute` functions.