Vulnerabilities

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: algif_skcipher - force synchronous processing on trees without ctx-&gt;state<br /> <br /> The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-&gt;iv<br /> directly into the skcipher request. After io_submit() the socket lock is<br /> dropped and the request is processed asynchronously, so a concurrent<br /> sendmsg(ALG_SET_IV) can overwrite ctx-&gt;iv and make the in-flight request<br /> run under an attacker-controlled IV. For CTR/stream modes this is<br /> IV/keystream reuse and lets an unprivileged user recover the plaintext of<br /> a concurrent operation.<br /> <br /> Snapshotting ctx-&gt;iv into per-request storage for the async path is not<br /> sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -<br /> the MSG_MORE inter-chunk IV chaining is carried solely by the in-place<br /> req-&gt;iv writeback, which a snapshot redirects into per-request memory that<br /> af_alg_free_resources() releases on completion, silently producing wrong<br /> output. Writing the IV back from the completion callback instead is not<br /> possible either: that would require lock_sock() there, but the callback can<br /> run in softirq/atomic context, so it must not sleep.<br /> <br /> Make the operation synchronous instead, which removes both the IV race and<br /> any writeback race. This is equivalent to the upstream resolution, commit<br /> fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the<br /> AIO socket path across net/ entirely and so produces the same end state for<br /> this file. This patch deviates from that commit deliberately: rather than<br /> removing AIO socket support tree-wide, which would be far too invasive for<br /> stable, it removes only the AIO branch in crypto/algif_skcipher.c.<br /> io_submit() now completes synchronously; AF_ALG async is rarely used in<br /> practice.<br /> <br /> The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,<br /> and is left alone to keep the fix minimal.<br /> <br /> Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000<br /> after the change; MSG_MORE chunked CTR output bit-identical to single-shot.

The Contact Form, Survey, Quiz &amp; Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the &amp;#39;_gallery_order_{post_id}&amp;#39; parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page.

The Forminator Forms – Contact Form, Payment Form &amp; Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the &amp;#39;draft&amp;#39; parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the &amp;#39;draft&amp;#39; parameter and read other users&amp;#39; saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the &amp;#39;Save and Continue&amp;#39; feature enabled.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer&amp;#39;s first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker&amp;#39;s session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.

The Kirki – Freeform Page Builder, Website Builder &amp; Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the &amp;#39;data&amp;#39; parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.

The WP Compress – Instant Performance &amp; Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Kirki – Freeform Page Builder, Website Builder &amp; Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s &amp;#39;bt_bb_shortcode&amp;#39; shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.