GHSA-VGRF-PR28-VF98 CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess

Summary The deleteProcess action accepts a POST parameter tables containing arbitrary table names. These are passed directly to $forge-dropTable without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables from the theme's own migration...

PT-2019-19333

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of a theme via the "/admin.php?action=theme delete&var1=" API endpoint. Recommendations For Pluck version 4.7.9-dev1, as a temporary workaround, consider restricting access to t...