Thomas Deuling

An unauthenticated attacker can access files uploaded by other visitors because the download link for files uploaded via a form uses a predictable token. Furthermore, the file name in the request is not verified against guessing. The token is also exposed in plain text within the text version of notification emails.

The order cancellation function allows any site visitor to set orders awaiting payment to a canceled status. This occurs because the function accepts an order identifier from the request and processes it without verifying if the caller owns the order. This issue requires a page that includes the shop's order plugin. Orders that have already been paid are not affected.

An unauthenticated attacker can inject HTML into a summary email because values entered by visitors are not properly escaped before being included in the email body.

The payment notification endpoint for PayPal accepts incoming data without verifying the source, allowing any site visitor to overwrite the stored payment notification of an order awaiting payment with arbitrary content. This issue requires a page containing the shop's order plugin to be present. Orders that have already been paid are not affected.

An authenticated, low-privileged backend user can exploit a backend AJAX endpoint used for inline editing that fails to restrict access to fields the user is not permitted to see or edit. By supplying arbitrary table, field, and record parameters, an attacker can trigger an error response that discloses the current database value of the requested field. This can lead to the exposure of sensitive information, including password hashes for both backend and frontend users. Exploitation requires a valid account with access to the extensions backend module.

An improper authentication issue exists in the TYPO3 Extension "Modules". The issue relates to authentication mechanisms within the extension.

An issue in the view statistics extension saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data, such as cleartext passwords if ext:felogin is installed, may be saved.