Base de CVEs

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.