Transposh Translation Plugin up to 1.0.8.1 on WordPress POST Parameter wp/transposh_db.php improper authorization

Summaryinfo

A vulnerability classified as critical was found in Transposh Translation Plugin up to 1.0.8.1 on WordPress. Affected by this vulnerability is an unknown functionality of the file wp/transposh_db.php of the component POST Parameter Handler. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2022-2536. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Transposh Translation Plugin up to 1.0.8.1 on WordPress (WordPress Plugin). It has been declared as critical. This vulnerability affects an unknown function of the file wp/transposh_db.php of the component POST Parameter Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."

The weakness was presented 12/15/2022 as 168120. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-2536 since 07/25/2022. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1548.002.

It is possible to download the exploit at exploitalert.com. It is declared as proof-of-concept. By approaching the search of inurl:wp/transposh_db.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Transposh Translation Plugin

Version

• 1.0.8.0
• 1.0.8.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion