Pablo Santiago

**Nome do Software Vulnerável e Versões Afetadas** Quick Playground versões anteriores a 1.3.5 **Descrição** O plugin Quick Playground para WordPress contém uma falha de path traversal. A função `qckply data()` processa o parâmetro POST `filename` e o passa para `file get contents()` sem a devida validação, sanitização ou restrições de caminho. Isso permite que atacantes autenticados com nível de acesso de Administrador ou superior leiam arquivos arbitrários no servidor, como `wp-config.php` ou `/etc/passwd`. Este problema é explorável apenas se o site estiver sendo executado em `playground.wordpress.net` ou tiver sido sincronizado com o WordPress Playground, indicado pela opção `is qckply clone` estar ativada. **Recomendações** Atualize o plugin para uma versão posterior a 1.3.4. Como mitigação temporária, restrinja o acesso à função `qckply data()` ou garanta que a opção `is qckply clone` esteja desativada se não for necessária.

**Name of the Vulnerable Software and Affected Versions** Beehive Forum version 1.5.2 **Description** Beehive Forum version 1.5.2 has a host header injection flaw in the forgot password feature. This allows attackers to alter password reset requests. By injecting a malicious host header, attackers can intercept password reset tokens and change victim account passwords without needing to authenticate directly. The affected functionality involves manipulating password reset requests. **Recommendations** Apply a fix for the host header injection flaw in the forgot password functionality.

**Name of the Vulnerable Software and Affected Versions** Schben Adive version 2.0.7 **Description** The issue allows remote unprivileged users, such as editors or developers, to create an administrator account. This can be achieved via the `admin/user/add` endpoint, as demonstrated by a Python proof-of-concept script. **Recommendations** For Schben Adive version 2.0.7, consider restricting access to the `admin/user/add` endpoint until a patch is available. As a temporary workaround, limit the ability of unprivileged users to create new administrator accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BearDev JoomSport plugin version 3.3 **Description** The issue allows SQL injection, which can be used to steal, modify, or delete database information. This is achieved via the `joomsport season/new-yorkers/?action=playerlist` API endpoint, specifically through the `sid` parameter. **Recommendations** For BearDev JoomSport plugin version 3.3, consider restricting access to the `joomsport season/new-yorkers/?action=playerlist` API endpoint to minimize the risk of exploitation. Avoid using the `sid` parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.