Harald Eilertsen

توجد مشكلة تزوير الطلبات عبر المواقع (CSRF) في نقطة نهاية OAuth2 ’/authorize‘، والتي تتم معالجتها بواسطة الدالة `post()` داخل `ZotlabsModuleAuthorize`. يحدث هذا لأن النظام يفشل في التحقق من صحة رموز CSRF أو رؤوس Origin/Referer أثناء طلبات POST عبر الأصول. يمكن لمهاجم غير مصدق استغلال هذه الثغرة باستخدام نموذج HTML ضار لإرسال معلمات OAuth2 عشوائية، مثل `client id` و`client secret` و`redirect uri` و`scope`. وهذا يسمح للمهاجم بتسجيل تطبيق OAuth2 دائم بصمت تحت حساب مستخدم مصدق، مما قد يؤدي إلى اعتراض رموز تفويض OAuth2 المستقبلية عندما يقوم الضحية بالمصادقة عبر العميل الذي يتحكم فيه المهاجم.

The issue allows an attacker to craft a malicious request, exploiting the lack of protection against CSRF attacks in the modified version of Tiny File Manager. This can trick a logged-in admin into submitting a form that creates an archive of any files or directories on the target server. The created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted. This makes it possible to leak sensitive files, such as the WordPress configuration containing database credentials and secrets.

The issue allows an attacker to inject javascript into a site via a crafted URL, as the plugin does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode.

The issue allows an attacker to trick a user into changing their profile information by sending a crafted request to the Edit Profile page, due to the lack of nonce checks when processing POST requests.

The issue lacks authorization checks and does not validate the `a` request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.

The issue allows an attacker to trick logged-in users into performing various actions on their behalf on the site due to the lack of CSRF checks for AJAX actions.

The issue is related to an obfuscated backdoor injected in the license checking code of the School Management WordPress plugin, which registers a REST API handler. This allows an unauthenticated attacker to execute arbitrary PHP code on the site, potentially leading to full control over the application. The estimated number of potentially affected devices worldwide is over 340,000, as the plugin's creator, Weblizar, claims to have more than 340,000 clients using its premium and free WordPress themes and plugins. The vulnerability was discovered in the premium versions of the plugin prior to 9.9.7 and is considered highly severe.

The AccessPress Themes vendor's website was compromised, resulting in numerous plugins and themes being backdoored. Only plugins and themes downloaded via the vendor's website are affected, while those hosted on wordpress.org are not. The affected plugins and themes have been updated or removed to avoid confusion.

The issue concerns a lack of CSRF checks in the `del reistered domains` AJAX action, making it susceptible to a CSRF attack. This allows an attacker to potentially manipulate the deletion of registered domains without proper validation.

The issue concerns missing authorization checks in several AJAX actions, allowing a logged-in user to modify or delete objects belonging to other users on the site. This affects critical operations such as modifying or deleting objects.

The issue allows an attacker to trick a logged-in user into submitting a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site. This is due to several AJAX actions lacking CSRF protections and allowing insecure direct object references that were not validated.

The issue allows unauthenticated visitors to upload arbitrary files, including executable code like php scripts, to the uploads/workreap-temp directory due to the lack of nonce checks and validation in the `workreap award temp file uploader` and `workreap temp file uploader` AJAX actions. The uploaded files are not sanitized or validated.

The issue is related to a lack of authentication or validation in certain AJAX handlers, specifically `motor load more`, `motor gallery load more`, `motor quick view`, and `motor project quick view`, which can allow an unauthenticated attacker to access arbitrary files on the server file system and execute arbitrary PHP scripts already present on the server. There is no vulnerability found for uploading files with this theme, meaning any executable scripts must already exist on the server.

The issue allows a remote attacker to upload arbitrary files using the manual update functionality, leading to an unauthenticated remote code execution.