Kamil Królikowski

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 **Description** An authenticated attacker can upload arbitrary files, including PHP scripts, because the system does not validate the types of uploaded files. This flaw can lead to Remote Code Execution (RCE), which allows an attacker to execute arbitrary commands on the server. There have been reports of elevated activities targeting this software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Blue Captcha versions prior to 2.0.2 **Description** The Blue Captcha plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are legitimate—on the main admin panel ('blcap main page') and the Hall of Shame and Log subpages. These pages accept the `blcap action` or `action` parameters from `$ REQUEST` and execute destructive operations through functions such as `blcap uninstall()`, `blcap delete logs()`, `blcap delete ip db()`, and `update option('blcap settings')` without verifying the request origin. Consequently, unauthenticated attackers can force a site administrator to uninstall the plugin, delete audit logs, remove Hall of Shame entries, or add arbitrary IP addresses to the block list by tricking them into clicking a malicious link. **Recommendations** Update the plugin to a version later than 2.0.1.