Thomas Sanzey

A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the `secu ` anti-forgery parameter is omitted in the 'crayons store.php' endpoint, causing the authorization dispatcher to resolve an unconditionally-true handler instead of performing the proper modification check. This flaw can be chained to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, resulting in arbitrary PHP code execution as the web-server user.

An arbitrary file upload flaw exists because the plugin extracts the file extension before sanitization and allows the `file type` parameter to be controlled by an attacker instead of restricting it to administrator-configured values. Validation is performed on the unsanitized extension, but the file is saved using a sanitized extension, allowing special characters such as `$` to be stripped during the save process. This enables unauthenticated attackers to upload arbitrary PHP files, potentially leading to remote code execution. Real-world exploitability is restricted by name randomization and the presence of an .htaccess file.

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress has a flaw that allows for arbitrary file uploads. This is due to inadequate file type validation within the `dnd upload cf7 upload` function. An unauthenticated attacker could potentially upload arbitrary files to the server, which could lead to remote code execution. This is exploitable when a form includes a multiple file upload field and allows all file types ('*').

Unauthenticated attackers can perform blind SQL Injection, a technique used to extract information from a database by asking true or false questions through the application. This is possible due to insufficient escaping of user-supplied parameters and a lack of preparation in the existing SQL query. The issue allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database via the `cgLostPasswordEmail` and `cgl mail` parameters.

The issue is related to Stored Cross-Site Scripting via imported folder titles due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It may also be possible to socially engineer an administrator into uploading a malicious folder import.

The issue arises from the plugin not properly validating the path of an uploaded file prior to deletion, allowing unauthenticated attackers to delete arbitrary files. This can include critical files such as the wp-config.php file, potentially leading to site takeover and remote code execution.

The issue is a buffer overflow. It affects D-Link DCS-5220 devices that are no longer supported by the maintainer.