Basant Kumar

An input validation issue allows authenticated attackers to cause a denial of service. By submitting Tiptap JSON where the `attrs.href` field is set as an array instead of a string, an unhandled TypeError is triggered in the `isAllowedUri()` function when the value is passed to `preg match()`. This allows attackers to persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

A stored cross-site scripting issue exists in the customer signup flow. The `Signup::addUser()` controller copies raw POST `username` values into the `display name` field before sanitization. This allows attackers to submit HTML and script markup in the `username` field during signup; while the markup is stripped from the username column, it is persisted in the `display name` column. The script executes when the `display name` is rendered without encoding in vulnerable views.

An unrestricted file upload issue exists in the plugin upload endpoint. This allows users with super admin privileges to execute arbitrary PHP code by uploading a malicious plugin ZIP file. The attack involves crafting a ZIP archive containing a `plugin.php` file with a valid Slug header and a `public/index.php` file containing arbitrary PHP code. This code executes with the permissions of the web server user when accessed through unauthenticated HTTP requests to the public path of the plugin.

An uncontrolled recursion issue exists in the admin controller dispatch cycle. The `Base::init()` function repeatedly invokes the `permission()` function on error handlers, leading to infinite recursion that exhausts PHP memory limits. A low-privilege user can trigger this by sending sustained requests to forbidden admin URLs, resulting in a denial of service for legitimate traffic by exhausting PHP memory across all workers.

An information disclosure issue allows unauthenticated attackers to enumerate files and directories. This occurs because multiple paths lack proper index directives in .htaccess files, which are configuration files used by Apache web servers to control directory-level settings. Attackers can access admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates that contain sensitive route maps.

An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the `r` query parameter and ` component ajax` POST parameter. This occurs because the `isEditor()` function does not perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization. Attackers can use a malicious link or an auto-submitted form to execute controlled JavaScript within the context of the Vvveb origin.

An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule.

A hard-coded credentials issue exists in the `docker-compose-apache.yaml` configuration. This allows unauthenticated attackers to access the bundled phpMyAdmin container using pre-configured database credentials. By connecting to the phpMyAdmin port, attackers can obtain unrestricted read and write access to the entire database, including administrator password hashes, customer personally identifiable information, and order data, which can lead to account takeover and data manipulation.

An unrestricted file upload issue exists in the media upload handler. Authenticated users with media-upload permissions can bypass extension restrictions by uploading a `.htaccess` file to map `.phtml` extensions to the PHP handler. This allows the upload of a `.phtml` file containing arbitrary PHP code, which can be executed by sending an unauthenticated HTTP GET request to the uploaded file, leading to remote code execution with web server privileges.

An XML external entity (XXE) injection issue exists in the admin Tools/Import feature. Authenticated `site admin` users can exploit the XML parser configuration in the 'system/import/xml.php' endpoint to inject `file://` or `php://filter` entity references. These references are resolved and persisted into the application database, allowing for arbitrary file disclosure and the overwriting of administrator password hashes to achieve privilege escalation.

The admin code editor allows authenticated users with low privileges, such as editor, author, contributor, or site admin roles, to execute arbitrary code. This is possible due to insufficient file extension restrictions, enabling attackers to write a malicious `.htaccess` file to map arbitrary extensions to the PHP handler. Subsequently, PHP code can be uploaded using those extensions to achieve remote code execution when the file is accessed via HTTP.

An information disclosure issue allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. By accessing the admin password-reset endpoint, a fatal error is triggered due to a missing namespace import. This exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler.