CVE-2023-45268 WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Hitsteps Hitsteps Web Analytics plugin = 5.86 versions...

CVE-2023-45268

CVE-2023-45268 describes a Cross-Site Request Forgery (CSRF) in Hitsteps Web Analytics WordPress plugin (versions

PT-2023-29474 · Unknown · Hitsteps Web Analytics

Name of the Vulnerable Software and Affected Versions: Hitsteps Web Analytics plugin versions = 5.86 Description: A Cross-Site Request Forgery CSRF issue affects the Hitsteps Web Analytics plugin. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

Wordpress Plugin Hitsteps Web Analytics Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hitsteps Web Analytics Type Plugin Vulnerable versions = 5.86 Fixed in 5.87 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45268 Patch priority Low CVSS severity Low 4.3 Developer Hitsteps PSID d49e0133f62f Credits Mika Required privile...

WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)

Software Hitsteps Web Analytics Type Plugin Vulnerable versions = 5.86 Fixed in 5.87 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45057 Patch priority Low CVSS severity Low 5.9 Developer Hitsteps PSID c79b55ce60ef Credits Rio Darmawan Required...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Executio...

Cross Site Scripting in Open Web Analytics on most statistics related pages

Description The makeJson method within the owatemplate class generates a JSON string in an unsafe manner. This method is utilized within the report.tpl file, where it receives parameters from the URL and generates a JSON string using them without properly sanitizing. Proof of Concept The...

Open Web Analytics 1.7.3 - Remote Code Execution (RCE)

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with ' use exploit/multi/http/openwebanalyticsrce msf...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

Vulnerable Application Open Web Analytics OWA before 1.7.4...

Open Web Analytics Information Disclosure (CVE-2022-24637)

A command execution vulnerability exists in Open Web Analytics. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Open Web Analytics 1.7.3 Remote Code Execution

Exploit Title: Open Web Analytics 1.7.3 - Remote Code Execution RCE Date: 2022-08-30 Exploit Author: Jacob Ebben Vendor Homepage: https://www.openwebanalytics.com/ Software Link: https://github.com/Open-Web-Analytics Version: 1.7.4 Tested on: Linux CVE : CVE-2022-24637 import argparse import...

Open Web Analytics 1.7.3 - Remote Code Execution Exploit

Exploit Title: Open Web Analytics 1.7.3 - Remote Code Execution RCE Exploit Author: Jacob Ebben Vendor Homepage: https://www.openwebanalytics.com/ Software Link: https://github.com/Open-Web-Analytics Version: 1.7.4 Tested on: Linux CVE : CVE-2022-24637 import argparse import requests import base6...

Open Web Analytics 1.7.3 - Remote Code Execution

Exploit Title: Open Web Analytics 1.7.3 - Remote Code Execution RCE Date: 2022-08-30 Exploit Author: Jacob Ebben Vendor Homepage: https://www.openwebanalytics.com/ Software Link: https://github.com/Open-Web-Analytics Version: 1.7.4 Tested on: Linux CVE : CVE-2022-24637 import argparse import...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Open Web Analytics OWA...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Exploit for the Unauthenticated RCE in Open...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Exploit for the Unauthenticated RCE in Open...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

AS SEEN ON EXPLOITDB: https://www.exploit-db.com/exploits/51026...

Information Disclosure

open-web-analytics/open-web-analytics is vulnerable to information disclosure. The vulnerability exists in fileCache.php due to the use of single quotes in '?php\n/' which allows an attacker to gain access to the sensitive information and perform code execution...

Improper Privilege Management in Open Web Analytics

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...