Custom Registration Form Builder: Potential Deserialization and RCE in PayPal Service

- **Plugin Name**: Custom Registration Form Builder with Submission Manager - **File Path**: `/custom-registration-form-builder-with-submission-manager/tags/6.0.6.7/services/class_rm_paypal_service.php` - **Last Change**: Revision 3402449 by metagauss, 3 months ago - **File Size**: 25.3 KB - **Vulnerability Information**: - Potential security issues could arise from improper input validation and sanitization, especially when handling user-submitted data in functions like `charge`, `charge_popup`, and `process_paypal_sdk_payment`. - The use of `maybe_unserialize` in `callBack` function could be a potential security risk if not properly sanitized. - The use of `eval` in various parts of the code (if any) could be a severe security vulnerability. - **Notable Functions**: - `callBack`: Handles payment status and processes the logic based on the status. - `charge`: Handles the charging process for PayPal payments. - `charge_popup`: Handles the charging process for the modern PayPal method. - `process_paypal_sdk_payment`: Processes payments using the PayPal SDK. - **Potential Exploit Points**: - Lack of proper validation and sanitization in user input handling could lead to SQL injection or XSS attacks. - Improper handling of serialized data could lead to arbitrary code execution.

Goal Reached Thanks to every supporter — we hit 100%!

Custom Registration Form Builder: Potential Deserialization and RCE in PayPal Service