Noman Riffat

O plugin Ultimate Membership Pro para WordPress está vulnerável a ataques de contorno de autenticação. Isso permite que invasores não autenticados façam login como qualquer usuário, incluindo o administrador do site com o ID de usuário padrão 1, por meio do `username` ou do `user ID`.

The issue allows directory traversal, enabling the reading of arbitrary files. This is achieved through the `op` and `tmpl` parameters in a specific API endpoint, "/page" with `tmpl=../`, allowing access to files outside the intended directory.

The issue allows for arbitrary file upload via the cgi-bin/up.cgi endpoint. This can potentially be combined with other issues to achieve remote code execution by uploading a .html file containing short codes, served over HTTP.

The issue allows an attacker to access the "/admin/" directory without credentials. An attacker can enable SSH from "/admin/system advanced.php?lang=en" and login with the default root password `welc0me`.

The issue allows authentication bypass. This can be achieved by including a specific header in the request, namely "Cookie: Name=0admin".

The issue allows authentication bypass by ignoring the `parent.location='login.html'` JavaScript code in the response to an unauthenticated request.

Name of the Vulnerable Software and Affected Versions: GPS Tracking Software (self hosted) versions through 3.0 Description: The issue allows remote attackers to inject arbitrary PHP code via a crafted request. This is mishandled during admin log viewing. For example, using `<?php system($ GET[cmd]); ?>` in a login request can demonstrate this issue. Recommendations: For versions through 3.0, consider disabling the `writeLog` function in fn common.php as a temporary workaround until a patch is available. Restrict access to admin log viewing to minimize the risk of exploitation. Avoid using the `cmd` variable in requests until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: gps-server.net GPS Tracking Software (self hosted) versions 2.x Description: The issue concerns a password reset procedure that allows immediate password resets upon an unauthenticated request. After the reset, an email is sent with a new, predictable password based on the date, making it easier for remote attackers to gain access by predicting this password. This is due to the use of `gmdate` for password creation in the `fn connect.php` file. Recommendations: For gps-server.net GPS Tracking Software (self hosted) versions 2.x, consider modifying the password reset procedure to generate unpredictable passwords and implement additional authentication steps to prevent unauthorized resets. As a temporary workaround, restrict access to the password reset functionality until a more secure solution is implemented.