Leonid Semenenko

An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database via the `stm lat` and `stm lng` parameters.

Unauthenticated attackers can perform SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, by manipulating the `referer` parameter. This occurs because the plugin does not sufficiently escape user-supplied input or properly prepare the SQL query, allowing the addition of unauthorized queries to extract sensitive information from the database.

An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. By manipulating the `mc auth` parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

An Arbitrary File Write issue exists due to unsafe ZIP file extraction within the `ampforwp save local font()` function, coupled with inadequate cleanup that fails to remove nested directories and files. Authenticated attackers with Author-level access or higher, and permissions granted by an Administrator, can write arbitrary files to a web-accessible location on the server. This may lead to remote code execution on hosts that execute PHP files in the uploads directory.

The Contest Gallery plugin for WordPress contains a SQL Injection flaw. This occurs because the unauthenticated 'post cg gallery form upload' AJAX action fails to properly escape the `form input` parameter and lacks sufficient preparation of the SQL query within the 'cb' branch of the `users-upload-check.php` file, where the `$f input id` variable is concatenated unquoted into a SELECT statement. The endpoint is protected only by a public frontend nonce (`cg1l action` / `cg nonce`) visible in the page source of public gallery pages. This allows unauthenticated attackers to append malicious SQL queries to extract sensitive information from the database.

Insufficient file path validation in the become-dealer logo upload flow allows authenticated users with subscriber level access and above to delete arbitrary files on the server. This occurs because the profile update handler permits the setting of an arbitrary filesystem path.

The Betheme theme for WordPress allows authenticated attackers with author-level access or higher to upload arbitrary files, including PHP scripts. This occurs because the `upload icons()` function moves and unzips user-controlled ZIP files into a public uploads directory without validating the types of the extracted files. This flaw can lead to remote code execution via the Icons icon-pack upload flow.

The Betheme theme for WordPress allows authenticated attackers with contributor-level access and above to move or delete arbitrary local files via path traversal. This occurs because the `upload icons()` function uses a user-controlled upload path `mfn-icon-upload` in a filesystem move operation without restricting it to the uploads directory.

The Geo Mashup plugin for WordPress contains a time-based blind SQL Injection, a technique that allows an attacker to infer data by observing the time the server takes to respond to specific queries. The issue exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can exploit the `geo mashup null fields` parameter to append additional SQL queries and extract sensitive information from the database.

Insufficient file type validation occurs when custom blacklist types are configured, as the system replaces the default dangerous extension denylist instead of merging with it. Additionally, the `wpcf7 antiscript file name()` function can be bypassed using filenames containing non-ASCII characters. This allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, potentially leading to remote code execution.

An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. The flaw is triggered via the `packages` parameter, allowing attackers to append additional SQL queries to extract sensitive information from the database.

A logic flaw exists in the `topic add()` and `topic edit()` action handlers that allows authenticated users with subscriber-level access and above to delete arbitrary files writable by the PHP process. The issue occurs because the handlers accept arbitrary user-supplied `data` arrays from `$ REQUEST` and store them as postmeta. An attacker can provide a malicious file path via the `data[body][fileurl]` parameter, which is then persisted in the database. When a subsequent `topic edit` request is made using the `wpftcf delete[]=body` parameter, the `add file()` method retrieves the stored path, processes it through `wpforo fix upload dir()`, and passes the unvalidated path to `wp delete file()`, enabling the deletion of critical files such as `wp-config.php`.

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions up to and including 2.4.16 Description The wpForo Forum plugin for WordPress is susceptible to arbitrary file deletion due to a missing file name/path validation against path traversal sequences. Authenticated attackers with subscriber level access or higher can delete arbitrary files on the server by embedding a crafted path traversal string within a forum post body and then deleting the post. Recommendations Update the wpForo Forum plugin to a version later than 2.4.16.

The WP Job Portal plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and insufficient SQL query preparation. Specifically, the `radius` parameter is not properly escaped, allowing unauthenticated attackers to inject additional SQL queries into existing database queries. This could enable attackers to extract sensitive information from the database.