Benjamin Lim

A flaw exists in CyberArk Secure Web Sessions Extension on Chrome and Edge that could lead to a denial of service when initiating new Secure Web Sessions (SWS) sessions. The issue is due to improper input validation.

The issue allows unauthenticated attackers to insert arbitrary JavaScript or HTML code that runs on all pages served by WordPress. This is achieved via the `sgcgoogleanalytic` parameter. The `saveGoogleCode()` function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

The issue allows unauthenticated attackers to execute SQL queries in the context of the web server due to a lack of prepared statements and sanitization of the `oId` variable in the `saveGoogleAdWords()` function.

The issue is related to a cross-site scripting (XSS) problem.