Benjamin Lim

Existe uma falha na Extensão CyberArk Secure Web Sessions no Chrome e no Edge que pode levar a uma negação de serviço ao iniciar novas sessões Secure Web Sessions (SWS). O problema deve-se à validação de entrada inadequada.

The issue allows unauthenticated attackers to insert arbitrary JavaScript or HTML code that runs on all pages served by WordPress. This is achieved via the `sgcgoogleanalytic` parameter. The `saveGoogleCode()` function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

The issue allows unauthenticated attackers to execute SQL queries in the context of the web server due to a lack of prepared statements and sanitization of the `oId` variable in the `saveGoogleAdWords()` function.

The issue is related to a cross-site scripting (XSS) problem.