Marco Wotschka

يتضمن البرنامج ملفات .htaccess ضارة في الإصدار 1.7.0. تحتوي هذه الملفات على توجيهات مصممة لمنع تنفيذ نصوص برمجية محددة، بينما تسمح بتنفيذ ملفات PHP ضارة معروفة. إذا تم نقل هذه الملفات من دليل المكون الإضافي، فقد تؤدي إلى تعطيل التشغيل الطبيعي للموقع. تُستخدم ملفات .htaccess للتحكم في الوصول إلى ملفات ومجلدات محددة على خادم الويب.

يحتوي البرنامج على ثغرة ناتجة عن عدم كفاية عملية تنقية المدخلات وتهريب المخرجات في السمات التي يقدمها المستخدم داخل الرموز المختصرة للمكوّن الإضافي. وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بحق الوصول على مستوى «المساهم» أو أعلى بإدخال نصوص برمجية ويب تعسفية في الصفحات. وسيتم تنفيذ هذه النصوص البرمجية عندما يقوم مستخدم بالوصول إلى الصفحة المتأثرة.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: المكوّن الإضافي BeeTeam368 Extensions لـ WordPress حتى الإصدار 2.3.5 بما في ذلك الوصف: المكوّن الإضافي BeeTeam368 Extensions لـ WordPress معرض لخطر تحميل ملفات عشوائية بسبب عدم وجود التحقق من نوع الملف في الدالة `handle submit upload file()`. وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بحقوق وصول على مستوى «المشترك» أو أعلى بإرسال ملفات عشوائية إلى الخادم المتأثر، مما قد يؤدي إلى تنفيذ التعليمات البرمجية عن بُعد. التوصيات: المكوّن الإضافي BeeTeam368 Extensions لـ WordPress حتى الإصدار 2.3.5 ضمناً: قم بالتحديث إلى إصدار أعلى من 2.3.5.

The issue allows unauthorized modification of the plugin's license key due to a missing capability check on the `actions` function. This makes it possible for unauthenticated attackers to modify or delete the license key.

The issue is related to Reflected Cross-Site Scripting via the `search term` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the moderator code and viewer code fields. This allows authenticated attackers with author privileges or higher to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability can be exploited by attackers with author privileges to inject arbitrary scripts, which are executed during user interactions.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Reflected Cross-Site Scripting via the `selected option` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Recommendations: For versions up to, and including, 3.0.8, update to a version later than 3.0.8 to resolve the issue. As a temporary workaround, consider restricting access to the `selected option` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Reflected Cross-Site Scripting via the `page` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Recommendations: For versions up to, and including, 3.0.8, update to a version later than 3.0.8 to resolve the issue. As a temporary workaround, consider restricting access to the `page` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `module all toggle ajax()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site, potentially allowing them to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Recommendations: For versions up to, and including, 3.0.8, update to a version that includes a fix for this issue. As a temporary workaround, consider disabling the `module all toggle ajax()` function until a patch is available. Restrict access to the WordPress site to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue allows authenticated attackers with Contributor-level access and above to duplicate posts written by other authors, including admins, due to missing validation on a user-controlled key in the `duplicate post` function. This includes the ability to duplicate password-protected posts, revealing their contents. Recommendations: For versions up to, and including, 3.0.8, update to a version that fixes the Insecure Direct Object Reference vulnerability. As a temporary workaround, consider restricting access to the `duplicate post` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue allows authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information, via the `download file ajax` function. This enables potential exposure of sensitive data on the server. Recommendations: For WP Extended plugin for WordPress versions up to, and including, 3.0.8, update to version 3.0.9 to secure your site. As a temporary workaround, consider disabling the `download file ajax` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to extract sensitive data, including usernames, hashed passwords, and emails, via the `download user ajax` function. This makes it possible for attackers to obtain sensitive information. Recommendations: For versions up to, and including, 3.0.8, consider disabling the `download user ajax` function as a temporary workaround until a patch is available. Restrict access to sensitive data and limit Subscriber-level access to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress version 3.0.8 and earlier Description: The issue allows authenticated attackers with Subscriber-level access and above to change an admin's username to a username of their liking, as long as the default 'admin' was used, due to a missing capability check on the `wpext change admin name()` function. Recommendations: For versions up to and including 3.0.8, update the plugin to the latest patched version immediately to resolve the issue. As a temporary workaround, consider restricting access to the `wpext change admin name()` function until a patch is available.

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `output sub admin page 0` function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

The issue allows authenticated attackers to store backups in arbitrary folders on the server, provided they can be written to by the server. This is achieved via the job-specific backup folder. Default settings will place an index.php and a .htaccess file into the chosen directory when the first backup job is run, intended to prevent directory listing and file access. An attacker could set the backup directory to the root of another site in a shared environment, thus disabling that site.

The issue is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This allows authenticated attackers, with subscriber access or higher, to execute various AJAX actions, including changing the permalink structure and plugin settings.

Name of the Vulnerable Software and Affected Versions: Conditional Fields for Contact Form 7 plugin for WordPress versions up to, and including, 2.4.13 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `wpcf7cf admin init` function. This allows unauthenticated attackers to reset the plugin's settings via a forged request if they can trick a site administrator into performing an action such as clicking on a link. Recommendations: For versions up to, and including, 2.4.13, update to a version that includes the fix for the missing or incorrect nonce validation on the `wpcf7cf admin init` function. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

The issue is due to missing or incorrect nonce validation on the `ajax theme activation` function, making it possible for unauthenticated attackers to activate arbitrary installed themes via a forged request. This can happen if an attacker can trick a site administrator into performing an action such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `ajax plugin activation` function. This allows unauthenticated attackers to activate arbitrary installed plugins via a forged request if they can trick a site administrator into performing an action such as clicking on a link.