Lichoin

Missing authorization allows users with Contributor-level privileges to invoke external connection AJAX actions reserved for users with `manage options` permissions. An attacker can call the `dt verify external connection()` function by providing a specific `endpointId` and `url` to transmit stored connection credentials to a server under their control. Additionally, the `dt begin authorization()` function can be abused to create unauthorized connections.

Missing authorization allows unauthenticated clients to connect to the backoffice 'PreviewHub' and 'BackofficeHub' SignalR hubs. By completing the SignalR negotiate step, attackers can receive refreshed notifications that disclose content keys, including unpublished content, and reveal the timing of editorial activity.

A missing authorization issue exists in the `ajax push()` function. This allows users with Contributor-level permissions in a multisite environment to publish posts on other sites within the network. An attacker can exploit this by using the `dt-push` nonce along with a selected connection id and `postStatus` to create draft or published posts on sites they are not authorized to access.

An authorization bypass allows administrators who are not the ROOT USER to perform write actions by impersonating the protected ROOT USER account. This occurs because the read-only flag is not verified when a user logs in via the `loginas` parameter and sends a POST request to the '/add/cron/' endpoint. Consequently, the crond service executes the commands under the system account of the protected administrator.

Contributor-level users can instantiate PHP objects through double unserialization of distributed post meta. An attacker can store a serialized PHP string as meta, which is then processed by the `set meta()` function in includes/utils.php on the destination site. This allows the storage of attacker-defined objects, with the final impact determined by the available gadget classes (sets of existing code fragments that can be chained together to execute unintended actions).

Pre-authentication server-side request forgery occurs when the official ClickHouse driver plugin `plugins/drivers/clickhouse.php` is loaded. An unauthenticated attacker can provide `auth[driver]=clickhouse` and set the `auth[server]` variable to an arbitrary URL. This causes the server to send an HTTP POST request containing 'SELECT version()' to the specified host. Within the `rootQuery()` function, if the target returns an HTTP status code outside the 200-299 range (excluding 401 and 403), the raw HTTP response body is assigned to the connection error and displayed on the login page. This allows for internal network and port reconnaissance, as well as the disclosure of sensitive information such as stack traces, internal hostnames, file paths, and configuration identifiers found in internal error pages.

A pre-authentication Server-Side Request Forgery (SSRF) exists in the optional Elasticsearch driver located at `plugins/drivers/elastic.php`. The issue occurs because `adminer/include/auth.inc.php` calls the `Driver::connect()` function before validating the login result. An unauthenticated attacker can send crafted `auth[server]`, `auth[username]`, and `auth[password]` parameters to force the server to issue an HTTP GET request via `get url()` or `file get contents()` to an arbitrary reachable host and port. The driver fails to block loopback, private, or link-local addresses, and while it rejects ports below 1024, it appends the default port 9200 if none is provided. This allows for internal network reconnaissance and service fingerprinting, as connection failures and specific JSON error fields from non-2xx responses are displayed on the login page. This requires the Elasticsearch driver to be explicitly deployed and the PHP `allow url fopen` setting to be enabled.

An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider uses these coordinates as filesystem path components without rejecting parent-directory names, and the path-containment check utilizes an unnormalized resolved path. This allows an authenticated user with permissions to write and delete bundles in a bucket to upload a NAR with a crafted manifest, enabling file system operations outside of the intended file persistence directory.

The issue is related to a buffer overflow in memory, which can be exploited to elevate privileges. This can allow an attacker to affect the system.