Jonah Burgess

An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. The flaw is triggered via the `data` parameter. Successful exploitation allows the extraction of sensitive information from the database. This requires a searchable topic form field of type checkbox, or a select/autocomplete field with `isMultiChoice` enabled, to be registered in the forum configuration.

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LAST VIEW NAME value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Missing authorization across the Human Resources, Catalog, and Order Manager applications allows a remote unauthenticated attacker to disclose internal business records, such as organization, employee, product catalog, and product-store data. This occurs because several helper endpoints are configured to skip authentication and perform no permission checks before returning the requested records.

Improper Control of Generation of Code allows a remote unauthenticated attacker to execute arbitrary code on the server. The issue occurs when an attacker stages crafted widget XML via a multipart upload and overrides the `mainDecoratorLocation` used by a manager login route through an anonymous JSON request. This causes the system to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression (a dynamic scripting language for the Java platform) while rendering the authentication-failure page. The flaw is also reachable through the unauthenticated '/sfa/control/editPortalPageColumnWidth' endpoint, which can return command output directly in an HTTP 200 response.

Incorrect authorization in the `updateLayout` simple-method within `applications/content/minilang/layout/LayoutEvents.xml` allows a remote authenticated attacker with `OFBTOOLS VIEW` and `CONTENTMGR VIEW` permissions to execute arbitrary commands as the OFBiz process user. The issue occurs because the authorization check validates only the `CONTENT CREATE` operation instead of verifying update permissions on the specific Content record and the selected `DataResource`. An attacker can relink a `RESPONSE`-purpose Content record and convert a `DataResource` into an `OFBIZ FILE`/`FTL` resource. By poisoning the OFBiz access log via a crafted `User-Agent` header and accessing it through the `showContent` route, the attacker can achieve remote code execution.

An authorization issue occurs when multitenancy is enabled, allowing a remote authenticated attacker with a low-privilege account in one tenant to read and write data from another tenant. The attacker can achieve this by providing their own `userTenantId` parameter and credentials during the Party Manager login process while targeting a hostname mapped to a different tenant. This happens because the `LoginWorker` function() prioritizes the `userTenantId` request parameter over the tenant resolved by the `ContextFilter` via `TenantDomainName`. Consequently, subsequent requests use the attacker's session identity and security object for permission checks but execute read or write operations against the data of the tenant associated with the hostname.

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR CREATE or CONTENTMGR UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. Unauthenticated attackers can force administrators to approve pending user registrations or deny arbitrary user accounts, potentially locking users out of the site. This occurs because the `trigger bulk action()` function lacks proper nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. An attacker can bypass initial checks in `trigger query actions()` by providing an empty `new role` parameter, which redirects control to the unprotected `trigger bulk action()` handler and prevents the system's standard validation from executing.

An issue exists where unauthenticated attackers can perform blind SQL Injection, a technique used to extract information from a database by asking the server true or false questions. This occurs due to insufficient escaping of the `inputs` parameter and a lack of preparation in the SQL query. Attackers can append additional queries to extract sensitive data. The required nonce, a unique token used to prevent cross-site request forgery, is exposed on every public page that renders a form, allowing it to be easily obtained from the page source.

The Booking Calendar plugin for WordPress contains a flaw that allows unauthenticated attackers to extract sensitive customer data, such as names, email addresses, and phone numbers of individuals who have made bookings. This occurs through the `wpbc is show popover in flex timeline()` function.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs in the `wppb save avatar value()` function, where a zero-length multipart file branch writes raw request values directly to user meta, bypassing the validation performed by `wppb save attachment id()` and `wppb verify attachment id()`. The stored payload is subsequently treated as a WordPress attachment URL and rendered without escaping by the `wppb default fields make upload button()` function when an administrator views the compromised account.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into text-type custom fields, such as `phone`, which then execute when a user visits the affected page. The attack is carried out via the AJAX `geodir save post` endpoint by using entity-encoded angle brackets to bypass the `strpos()`-gated tag-stripping check.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can take over a guest author's forum post to modify the title, body, author name, and stored owner email address. This exploitation occurs via the `wpforo post edit` action and requires a forged `comment author email` cookie. The attack is only possible if guest posting and editing are enabled and the attacker knows the target guest author's email address.

The plugin is subject to information exposure through spoofing. The `is ai bot user()` function identifies privileged internal AI bot accounts by checking for the `'ai-chat-bot-'` prefix in a guest record's stored IP address. This IP address is taken directly from the client-controlled `X-Real-IP` request header during unauthenticated guest registration at the `/guests/register` endpoint. Consequently, unauthenticated attackers can register a guest identity that the system recognizes as an internal AI bot. This allows them to bypass the per-room role allowlist, draft-status checks, and join filters—which are bypassed by the bot check in `user can join()` and `user can read()` functions—enabling them to join administrator-restricted chat rooms, post messages, and read the private message history of other users.

The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the application fails to properly escape the `wcfmmp user location lng` parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by manipulating checkout coordinates to append additional queries, allowing the extraction of sensitive data, such as WordPress password hashes, from the database.

Unauthorized access and modification of data occur due to missing ownership verification on the '/users/customers/<id>' endpoint. Authenticated attackers with the `wpamelia-provider` role can view and modify arbitrary customer data, including triggering password resets. This can lead to the takeover of WordPress user accounts with roles up to Editor, provided the target user has made a booking through the plugin. This issue specifically affects the Premium version where the Employee Panel is enabled.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the `icn` parameter, enabling the execution of arbitrary web scripts if a user is tricked into clicking a malicious link.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `position button` parameter. These scripts execute whenever a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `HTTP X FORWARDED FOR` parameter. An attacker can trigger the `wppa log()` function by deliberately failing a nonce check for the `getshortcodedrenderedfenodelay` action, which causes the attacker-supplied value to be recorded to disk. This process is reachable through the `wp ajax nopriv wppa` endpoint, enabling the execution of arbitrary web scripts when a user accesses an affected page.