Adhikara13

The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue occurs because the `order by` parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with custom-level access or higher can append malicious SQL queries to extract sensitive information from the database.

The DT LMS – elearning WordPress plugin allows unauthenticated attackers to modify arbitrary plugin option values in the `wp options` table. This is caused by a missing capability check and lack of nonce verification in multiple AJAX handlers, including `dtlms save poc settings`, `dtlms save skin settings`, and `dtlms save options settings`. These handlers are registered on the `wp ajax nopriv *` hook and pass user-supplied data directly to the `update option()` function. An attacker can exploit this to overwrite Point-of-Contact email configurations and skin or branding settings, altering the appearance and behavior of the LMS for all visitors.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts into pages via custom field parameters. These scripts execute when a user accesses the affected page. The `booked add appt` AJAX action is protected by a nonce (a unique token used to prevent replay attacks) that is publicly embedded on any page rendering the booking calendar shortcode, allowing unauthenticated users to obtain it easily.

An unauthenticated Cross Site Request Forgery (CSRF) issue exists, which can lead to Stored Cross-Site Scripting (XSS). CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to take, while Stored XSS occurs when a malicious script is permanently stored on the target server and executed in the browser of users who visit the affected page.

Unauthorized access is possible due to a missing capability check in the `activate plugin()` function. This allows authenticated users with Subscriber-level permissions or higher to activate a limited set of plugins.

Unauthenticated Broken Access Control allows an attacker to bypass authorization restrictions without providing valid credentials.

The issue is a buffer overflow that can be triggered via the `pingWdogIp`. This allows attackers to cause a Denial of Service (DoS) by providing a crafted input.

A command injection issue was discovered via the `ddnsDomainName` parameter in the Dynamic DNS settings. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

A command injection issue was discovered in the Wake-On-LAN (WoL) function via the `wakeup mac` parameter. This issue can be exploited using a crafted payload.

The issue is related to a command injection vulnerability. This vulnerability can be exploited via a crafted payload, specifically through the `Hostname` parameter within the WAN settings.

The issue is related to a command injection vulnerability in the Changing Username and Password function. This vulnerability can be exploited via a crafted payload.

A command injection issue was discovered in the diagnostic tools page of the affected software. This issue can be exploited through a crafted HTTP request.

An issue in the diagnostic tools component of the admin management interface allows a remote attacker to execute arbitrary code via the `ping` and `traceroute` functions.