Vulnerabilidades

*** Pendiente de traducción *** The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the plugin's settings page handler BulkSeoImage(), which dispatches to launchbulk() / BulkSeoImageGo() whenever the request contains $_POST['bulkseoimage']. No wp_nonce_field() is emitted in the form and no check_admin_referer()/wp_verify_nonce() is performed before bulk-overwriting the _wp_attachment_image_alt post meta for every image attached to every published post and/or page. This makes it possible for unauthenticated attackers to bulk-overwrite image ALT-text metadata across the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

*** Pendiente de traducción *** The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb_ajax_delete_user() function in versions up to, and including, 1.0.0. The handler is registered against both `wp_ajax_cf7cdb_delete` and `wp_ajax_nopriv_cf7cdb_delete`, and it performs no nonce verification, no capability check, and no ownership check before invoking `$wpdb->delete()` against the `wp_cf7cdb_data` table with an attacker-supplied integer ID. This makes it possible for unauthenticated attackers to delete arbitrary contact form submission entries stored by the plugin by iterating sequential primary-key IDs.

*** Pendiente de traducción *** The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response data (specifically the value of any 'auth' key in a JSON response body) verbatim back to the attacker's browser, enabling direct exfiltration of responses from internal services such as cloud instance metadata endpoints.

*** Pendiente de traducción *** The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

*** Pendiente de traducción *** The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The HTTP response status from outbound requests is reflected back in the AJAX JSON response as status_code, providing an enumeration oracle usable for probing internal hosts and cloud metadata services.

*** Pendiente de traducción *** The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability check, and only a loose equality check between an attacker-supplied `reset_activation_code` POST parameter and the target user's `forgot_email` user meta value; when a user has never initiated a password reset, `get_user_meta()` returns an empty string that trivially satisfies this check against an omitted or empty attacker-supplied code. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by sending a crafted POST request to `admin-ajax.php` with `action=pravel_change_password`, `reset_user_id` set to the target account's user ID, and `new_password_custom` set to an attacker-chosen password. Successful exploitation allows the attacker to authenticate with the newly set password and fully take over the targeted account, achieving administrator-level privilege escalation on the affected site.

*** Pendiente de traducción *** The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

*** Pendiente de traducción *** The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because the plugin processes the [cincopa] shortcode via a comment_text filter hook, allowing unauthenticated visitors who can post comments to supply a malicious shortcode argument that persists in the database.

*** Pendiente de traducción *** The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missing or incorrect nonce validation on the main admin panel (blcap_main_page) and on the Hall of Shame and Log subpages, which accept a 'blcap_action' / 'action' parameter from $_REQUEST and perform destructive operations (plugin uninstall via blcap_uninstall(), log deletion via blcap_delete_logs(), Hall of Shame deletion via blcap_delete_ip_db(), and adding IPs to the banned list via update_option('blcap_settings')) with no wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() calls anywhere in the codebase. This makes it possible for unauthenticated attackers to uninstall the plugin, delete audit logs, remove Hall of Shame entries, and add arbitrary IP addresses to the block list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

*** Pendiente de traducción *** Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.<br /> <br /> <br /> `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)<br /> <br /> <br /> #### CNetSetObj::m_F_n_Set_Gate_way command injection<br /> <br /> The following function takes a string as a gatewy address, performs no sanitization on it and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. <br /> <br /> <br /> <br /> <br /> <br /> int __fastcall CNetSetObj::m_F_n_Set_Gate_way(const char **this, char *gw, char *dev)<br /> <br /> {<br /> <br /> char s[324]; // [sp+4h] [bp-144h] BYREF<br /> <br /> <br /> <br /> if ( !dev &amp;&amp; !*this || !gw )<br /> <br /> return 0;<br /> <br /> system("/sbin/route del -net 224.0.0.0 netmask 224.0.0.0");<br /> <br /> system("/sbin/route del default ");<br /> <br /> if ( dev )<br /> <br /> sprintf(s, "/sbin/route add default gw %s dev %s", gw, dev); //attacker controlled gw string<br /> <br /> else<br /> <br /> sprintf(s, "/sbin/route add default gw %s dev %s", gw, *this); //attacker controlled gw string<br /> <br /> system(s);<br /> <br /> sprintf(s, "/sbin/route add -net 224.0.0.0 netmask 224.0.0.0 gw %s dev %s", gw, *this); //attacker controlled gw string<br /> <br /> system(s);<br /> <br /> return 1;<br /> <br /> }

*** Pendiente de traducción *** Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.<br /> <br /> <br /> `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)<br /> <br /> <br /> #### CNetSetObj::m_F_n_Set_DNS_Addr command injection<br /> <br /> The following function can take up to two addresses, performs no sanitization and then calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. <br /> <br /> <br /> <br /> int __fastcall CNetSetObj::m_F_n_Set_DNS_Addr(CNetSetObj *this, char *dns1, char *dns2)<br /> <br /> {<br /> <br /> int result; // r0<br /> <br /> char v5[80]; // [sp+0h] [bp-50h] BYREF<br /> <br /> <br /> <br /> if ( !dns1 )<br /> <br /> result = 0;<br /> <br /> if ( dns1 )<br /> <br /> {<br /> <br /> sprintf(v5, "/bin/echo nameserver %s &gt; /etc/resolv.conf", dns1); // attacker controlled dns1 field<br /> <br /> system(v5);<br /> <br /> if ( dns2 )<br /> <br /> {<br /> <br /> sprintf(v5, "/bin/echo nameserver %s &gt;&gt; /etc/resolv.conf", dns2);<br /> <br /> system(v5);<br /> <br /> }<br /> <br /> return 1;<br /> <br /> }<br /> <br /> return result;

*** Pendiente de traducción *** Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.<br /> <br /> <br /> `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)<br /> <br /> <br /> #### CNetSetObj::m_F_n_Set_IP_Addr command injection<br /> <br /> The following function takes a string as an ip address, performs no sanitization and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. <br /> <br /> <br /> <br /> int __fastcall CNetSetObj::m_F_n_Set_IP_Addr(const char **this, char *ip_addr)<br /> <br /> {<br /> <br /> bool v2; // zf<br /> <br /> char v4[72]; // [sp+0h] [bp-48h] BYREF<br /> <br /> <br /> <br /> v2 = *this == 0;<br /> <br /> if ( *this )<br /> <br /> v2 = ip_addr == 0;<br /> <br /> if ( v2 )<br /> <br /> return 0;<br /> <br /> sprintf(v4, "/sbin/ifconfig %s %s", *this, ip_addr); // attacker controlled ip address <br /> <br /> system(v4);<br /> <br /> return 1;<br /> <br /> }