Search: common.php

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

This content describes a free, read-only bash script designed to triage WordPress sites for signs of compromise related to the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a third CVE-2026-115560. The script checks PHP versions, WordPress core and plugin integrity, suspicious PHP files in uploads, recent file modifications, common web-shell patterns, user accounts, cron jobs, logs, Docker containers, and configuration settings relevant to the vulnerabilities. It generates detailed Markdown reports without modifying the target systems. The PHP2Shell vulnerabilities are critical remote code execution bugs patched in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but the third CVE has no fixed build yet, with a recommended mitigation of setting session.upload_progress.enabled=0. The script helps detect potential backdoors planted before patching, as updating PHP alone does not remove them.

This update includes the following RPMs: php: * php-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-bcmath-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-cli-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-common-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-dba-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-dbg-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-devel-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-embedded-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-enchant-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-ffi-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-fpm-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-gd-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-gmp-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-intl-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-ldap-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-mbstring-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-mysqlnd-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-odbc-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-dblib-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-firebird-8.5.12-1.hum1 (aarch64, x86_64) * php-pgsql-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-process-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-snmp-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-soap-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-sodium-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-tidy-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-xml-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-8.5.12-1.hum1.src (src)

Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-91769 is a vulnerability in PHP's OpenSSL stream peer verification where certificate validation incorrectly accepts certificates with a host name mismatch. Specifically, if a certificate includes subjectAltName (SAN) entries, PHP improperly falls back to validating the Common Name (CN) when no SAN matches, violating RFC 6125. This flaw allows a certificate trusted for one hostname to be used to impersonate another, potentially enabling man-in-the-middle attacks. The vulnerability has a medium severity with a CVSS score of 4.3. No affected versions or patch information are explicitly provided.

This update includes the following RPMs: php: * php-8.5.11-2.hum1 (aarch64, x86_64) * php-bcmath-8.5.11-2.hum1 (aarch64, x86_64) * php-cli-8.5.11-2.hum1 (aarch64, x86_64) * php-common-8.5.11-2.hum1 (aarch64, x86_64) * php-dba-8.5.11-2.hum1 (aarch64, x86_64) * php-dbg-8.5.11-2.hum1 (aarch64, x86_64) * php-devel-8.5.11-2.hum1 (aarch64, x86_64) * php-embedded-8.5.11-2.hum1 (aarch64, x86_64) * php-enchant-8.5.11-2.hum1 (aarch64, x86_64) * php-ffi-8.5.11-2.hum1 (aarch64, x86_64) * php-fpm-8.5.11-2.hum1 (aarch64, x86_64) * php-gd-8.5.11-2.hum1 (aarch64, x86_64) * php-gmp-8.5.11-2.hum1 (aarch64, x86_64) * php-intl-8.5.11-2.hum1 (aarch64, x86_64) * php-ldap-8.5.11-2.hum1 (aarch64, x86_64) * php-mbstring-8.5.11-2.hum1 (aarch64, x86_64) * php-mysqlnd-8.5.11-2.hum1 (aarch64, x86_64) * php-odbc-8.5.11-2.hum1 (aarch64, x86_64) * php-pdo-8.5.11-2.hum1 (aarch64, x86_64) * php-pdo-dblib-8.5.11-2.hum1 (aarch64, x86_64) * php-pdo-firebird-8.5.11-2.hum1 (aarch64, x86_64) * php-pgsql-8.5.11-2.hum1 (aarch64, x86_64) * php-process-8.5.11-2.hum1 (aarch64, x86_64) * php-snmp-8.5.11-2.hum1 (aarch64, x86_64) * php-soap-8.5.11-2.hum1 (aarch64, x86_64) * php-sodium-8.5.11-2.hum1 (aarch64, x86_64) * php-tidy-8.5.11-2.hum1 (aarch64, x86_64) * php-xml-8.5.11-2.hum1 (aarch64, x86_64) * php-8.5.11-2.hum1.src (src)

Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as "><script>alert(1)</script>).

## Summary `Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy. The codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison. ## Affected product and version Product: Grav CMS, getgrav/grav Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3 ## Affected code `system/src/Grav/Common/Utils.php`, lines 1512 to 1521: ```php public static function verifyNonce($nonce, $action) { //Safety check for multiple nonces if (is_array($nonce)) { $nonce = array_shift($nonce); } //Nonce generated 0-12 hours ago if ($nonce === self::getNonce($action)) { return true; } //Nonce generated 12-24 hours ago return $nonce === self::getNonce($action, true); } ``` The nonce itself is `md5($tick . '|' . $action . '|' . $username . '|' . session_id() . '|' . Security::getNonceKey())`, computed in the private `generateNonceString()` a few lines above. `Security::getNonceKey()` is an installation level secret. So the value being compared with `===` is a value derived from a secret, which is exactly the case `hash_equals()` exists for. ## Proof of concept, verified, real output I could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP's `===` string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav's nonces have, 32 hex characters, an md5 digest. Step 1, confirm PHP build: ``` $ php -v PHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS) ``` Step 2, benchmark script, measures the median time of `$a === $b` over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length: ```php <?php // timing_poc2.php function timeCompare(string $a, string $b, int $iterations): float { $r = null; $start = hrtime(true); for ($i = 0; $i < $iterations; $i++) { $r = ($a === $b); } $end = hrtime(true); return ($end - $start) / $iterations; } function median(array $arr): float { sort($arr); $n = count($arr); $mid = intdiv($n, 2); return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2; } function runExperiment(int $len, int $iterations, int $trials): array { $secret = bin2hex(random_bytes((int)ceil($len / 2))); $secret = substr($secret, 0, $len); $wrongEarly = $secret; $wrongEarly[0] = ($secret[0] === 'a') ? 'b' : 'a'; $wrongLate = $secret; $last = $len - 1; $wrongLate[$last] = ($secret[$last] === 'a') ? 'b' : 'a'; $earlyTimes = []; $lateTimes = []; timeCompare($wrongEarly, $secret, 20000); timeCompare($wrongLate, $secret, 20000); for ($t = 0; $t < $trials; $t++) { $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations); $lateTimes[] = timeCompare($wrongLate, $secret, $iterations); } return [median($earlyTimes), median($lateTimes)]; } echo "=== Length 4096 bytes, establishes the primitive is not constant time ===\n"; [$e, $l] = runExperiment(4096, 20000, 15); printf("Median mismatch at position 0 : %.2f ns/op\n", $e); printf("Median mismatch at last position : %.2f ns/op\n", $l); printf("Ratio (late/early) : %.2fx\n\n", $l / $e); echo "=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\n"; [$e2, $l2] = runExperiment(32, 200000, 21); printf("Median mismatch at position 0 : %.2f ns/op\n", $e2); printf("Median mismatch at last position : %.2f ns/op\n", $l2); printf("Ratio (late/early) : %.2fx\n", $l2 / $e2); ``` Step 3, run it three times to confirm the result is reproducible and not noise: ``` $ php timing_poc2.php ``` Actual output, run 1: ``` === Length 4096 bytes, establishes the primitive is not constant time === Median mismatch at position 0 : 13.83 ns/op Median mismatch at last position : 338.58 ns/op Ratio (late/early) : 24.48x === Length 32 bytes, the actual Grav nonce length, md5 hex output === Median mismatch at position 0 : 14.13 ns/op Median mismatch at last pos

### Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. ### Details `Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint's dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`: ```php if (is_string($function) && !str_contains($function, '::') && Utils::isDangerousFunction($function)) { return false; } ``` Any callable string containing `::` — i.e. every `Class::method` static call — skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call's *arguments* are (separately) scanned for smuggled dangerous callables, never the target itself. `Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, ":")`) or a namespace backslash as dangerous — so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, '::')` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.) This is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design. ### PoC Tested on Grav `develop` at commit `db8c1fc` (which self-reports version 2.0.11) with the admin and form plugins, using an account granted only `admin.login` + `admin.pages` (page editor, not super-admin). The same guard is present in every current release from 2.0.7 through 2.0.10. Base URL shown as `https://grav.example`. **A. Arbitrary file read (confidentiality)** 1. Log in to `/admin` as the page-editor account (GET `/admin` for the login nonce, then POST `task=login`). 2. Save a page via the standard admin endpoint, `POST /admin/pages/<route>` with the session cookie, the admin nonce, and `data[frontmatter]` containing a form field with a `download` gadget directive: ```yaml forms: x: fields: y: type: text data-opts@: - 'Grav\Common\Utils::download' - '/etc/passwd' - false - 0 - 1024 - mime: 'text/plain' ``` The server returns `HTTP 200` and accepts the save — the `data-opts@` directive is not rejected. 3. As an unauthenticated visitor (no cookies), request the saved page, e.g. `GET /<route>` (use a fresh query string to avoid a cached copy; immediately after saving, a first request may `404` while the flat-file page index catches up — retry moments later). The response is `HTTP 200` with the raw contents of `/etc/passwd` in the body (`root:x:0:0:...`). Pointing the path at `user/accounts/<name>.yaml` instead returns that account file, including its `hashed_password:` bcrypt line — i.e. an anonymous visitor obtains a stored administrator's password hash. **B. Arbitrary file/directory write (integrity) — verified** Using the same mechanism with `Grav\Common\Filesystem\Folder::copy` (a public static method taking source and destination paths), a page editor caused the server to copy an existing page directory to an attacker-chosen new path under `user/pages/`; the newly created page then rendered its (attacker-controlled) content at the new route over plain HTTP. This demonstrates attacker-controlled creation of files/directories anywhere the web-server account can write. `Folder::move` and `Folder::delete` are equally reachable (their destructive nature was not exerci

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.