WordPress plugin Digital Lottery 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2024-33380

Name of the Vulnerable Software and Affected Versions Shafiq Digital Lottery versions 3.0.5 and earlier Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to...

WordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Digital Lottery versions = 3.0.5...

WordPress Digital Lottery Plugin <= 3.0.5 is vulnerable to Arbitrary File Upload

Software Digital Lottery Type Plugin Vulnerable versions = 3.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49242 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 7676461ee2c0 Credits stealthcopter Required privilege...

lotteryprediction.net Cross Site Scripting vulnerability OBB-3891169

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The minimum values of selectionMax and selectionSize are not verified when creating a lottery, which may create an unreasonable lottery

Lines of code Vulnerability details Summary src/LotterySetup.sol constructorLotterySetupParams memory lotterySetupParams if addresslotterySetupParams.token == address0 revert RewardTokenZero; if lotterySetupParams.ticketPrice == uint2560 revert TicketPriceZero; if lotterySetupParams.selectionSize...

Malicious user can frontrun the selling or transferring of a ticket to claim the rewards

Lines of code Vulnerability details A bad actor can trick a user into buying an unclaimed ticket and frontrun the selling or transfer of the NFT to claim the rewards associated with the ticket before the original transaction. Impact Given the described scenario, a bad actor can frontrun the...

Rounding division error could occur in the receiveRandomNumber function

Lines of code Vulnerability details Impact This rounding division error could result in the prize pool being drained over time if it occurs repeatedly, as the actual amount of prizes awarded would always be slightly less than the intended amount. Proof of Concept drawRewardSizedrawFinalized,...

Winnings might be unable to catch up with prize pot

Lines of code Vulnerability details Impact Profit may become ineffective, meaning that funds are effectively stuck in the contract. Proof of Concept Funds are owned by the Lottery and the only way out is through payouts. However, since the jackpot is bound by jackpotBound the expected payout taki...

drawCoolDownPeriod of 0 may allow frontrunning the draw with a winning ticket purchase

Lines of code Vulnerability details Impact Frontiness rather than luck may determine the winner. Proof of Concept drawCoolDownPeriod may be set to 0. Then a ticket may be bought in the same block as the draw. This allows for frontrunning the randomly selected winning ticket with a ticket purchase...

Lottery Insolvency can lead to unclaimable winning tickets despite paying out Frontend and Staking rewards

Lines of code Vulnerability details Impact Lottery Insolvency can lead to unclaimable winning tickets despite paying out Frontend and Staking rewards Proof of Concept When distributing the winning tokens, it is possible that there is an insufficient balance to be able to pay winning tickets while...

If random number is too low, the lottery not completely random

Summary Random numbers below a certain limit will always return at least one rightmost bit, while numbers above this limit will return random bits. Explanation: 1. The winning ticket is generated based on an array of numbers generated by module randomNumber to selectionMax-n.:...

Lottery owner can rig the draw to win the jackpot by swapping the source

Lines of code Vulnerability details Lottery owner can rig the draw to win the jackpot by swapping the source Impact The lottery owner has the ability to swap the Random Source under certain cirumstances, and this can be exploited to set a new source contract that returns any number set by it. Thi...

Lottery owner can manipulate the RNG to favour themselves, or other certain participants

Lines of code Vulnerability details The docs state that Chainlink VRF will be used as the source of randomness, whose subscription model is described here. A call is made to Chainlink's VRFCoordinatorV2 requestRandomWords function, after which a response is sent back in the form of a call to...

Source can change the result of the Lottery

Lines of code Vulnerability details Impact The loss of lottery winnings and incorrect distribution of funds Proof of Concept Reentrancy in Lottery.receiveRandomNumberuint256 src/Lottery.sol203-232: External calls: - winAmountdrawFinalizedselectionSize = drawRewardSizedrawFinalized,selectionSize /...

Malicious Package

Overview pancake-lottery-scheduler is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in pancake-lottery-scheduler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9afc5285dfcaaba15d9a85dce9d0f13865eb7b05f956012a289899817b0bb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5203 Malicious code in pancake-lottery-scheduler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9afc5285dfcaaba15d9a85dce9d0f13865eb7b05f956012a289899817b0bb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Extortion scheme impersonates government officials, law enforcement

The FBI issued a public warning this week about a fraud scheme wherein scammers impersonate government officials and law enforcement personnel. According to the PSA, the scammers spoof legitimate numbers and names and use fake credentials of well-known members of the government and law enforcemen...

bilbao-lottery.com Cross Site Scripting vulnerability OBB-1446838

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...