| Package | Affected versions | Patched versions |
|---|---|---|
| serendipity | = 0.3= 0.4= 0.5= 0.6= 0.7= 0.7.1= 0.8= 0.8.1= 0.8.2= 0.8.3= 0.8.4= 0.8.5= 0.9= 0.9.1= 1.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.1= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.2= 1.2.1= 1.3= 1.3.1= 1.4= 1.4.1= 1.5= 1.5.1= 1.5.2 | |
| wysiwyg editor | = 0.9= 0.91= 0.92= 0.93= 0.94= 0.95= 0.96 |
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free