Joshua Provoste

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the `redirect-url` parameter, which then executes in the user's browser.

The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the `cancel actions()` function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The issue allows unauthenticated attackers to extract sensitive data, including usernames and their respective password hashes, during a short window of time in which the backup is in process. This is possible via the class-ocm-backup.php file.

The issue arises from the plugin storing HTTP headers in the cached data, making it possible for unauthenticated attackers to poison the cache with custom HTTP headers that may be unsanitized, leading to Cross-Site Scripting. This vulnerability can be exploited by attackers to inject malicious content into the cache, potentially affecting users who access the cached content.

The issue arises from missing file type validation via the 'class fma connector.php' file, allowing authenticated attackers with Subscriber-level access or higher, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server. This could potentially make remote code execution possible. The vulnerable parameter is the file type, which is not properly validated, making it possible to upload malicious files.

The issue concerns a stored XSS vulnerability in the Filemanager component. This can be exploited via a .pxd file, as shown by sending `m1 files[]` to the "admin/moduleinterface.php" endpoint.

The issue allows remote code execution via a specially crafted .php.jpegd JPEG file. This can be achieved by sending a file as application/octet-stream to the `admin/moduleinterface.php` endpoint, specifically using the `m1 files[]` parameter. The file does not need to be a valid JPEG, but it should contain PHP code.

The issue allows for XSS and HTML injection via the `UserName` parameter in the "Default.aspx" endpoint.

The issue allows for CSRF attacks on ImageResourceDetail.aspx, potentially leading to content modifications and file uploads. It is noted that the product is self-hosted by the customer. However, the vendor disputes the existence of this issue, claiming it was reported without validation.

The issue arises from misleading information in the documentation of CKFinder, which may lead to the incorrect assumption that the application has built-in content sniffing protection.

An issue was discovered that allows remote attackers to upload files without any extension, even if the application was configured to accept files only with a defined set of extensions, due to improper checks of file names.