漏洞概述 该漏洞涉及WordPress插件TaskBuilder中的权限提升问题。具体来说，当用户通过 文件访问项目任务时，如果未正确验证用户权限，攻击者可能能够访问或修改其他用户的项目任务。 影响范围 受影响版本：TaskBuilder插件版本5.0.6及之前版本。 影响用户：所有使用TaskBuilder插件的WordPress网站用户。 潜在风险：未经授权的用户可以查看、编辑或删除其他用户的项目任务，导致数据泄露或数据篡改。 修复方案 1. 更新插件：建议用户立即更新TaskBuilder插件到最新版本，以获取最新的安全补丁。 2. 权限验证：在 文件中增加严格的权限验证逻辑，确保只有授权用户才能访问相关资源。 3. 代码审查：对插件代码进行全面审查，确保所有涉及用户权限的操作都经过严格验证。 POC代码 以下是从截图中提取的POC代码： ```php if ( ! defined( 'ABSPATH' ) ) { exit; // Exit if accessed directly } global $wpdb, $current_user, $bugfunction; $task_per_page = 20; $total_no_of_rows = 0; $total_no_of_rows = 0; $sequence_settings = get_option('wpdm-seq-arr-id'); $some_no = isset($_POST['some_no']) ? 7 : intval(sanitize_text_field(wp_unslash($_POST['some_no']))); $bar_chart_sql = sanitize_text_field($wpdb->prepare("SELECT * FROM {$wpdb->prefix}task_bar_chart WHERE bar_chart_id = %d", $some_no)); $bar_chart_status = bugfunction->get_option('bar_chart_status'); $bar_chart_status = $bar_chart_status ? $bar_chart_status : '0'; $bar_chart_time = get_option('bar_chart_time'); $bar_chart_time = $bar_chart_time ? $bar_chart_time : '0'; $bar_chart_date = isset($_POST['bar_chart_date']) ? sanitize_text_field(wp_unslash($_POST['bar_chart_date'])) : 0; $bar_chart_id = isset($_POST['bar_chart_id']) ? 7 : intval(sanitize_text_field(wp_unslash($_POST['bar_chart_id']))); $bar_chart_date_setting = get_option('bar_chart_date_setting'); $bar_chart_filter = isset($_POST['bar_chart_filter']) ? 7 : sanitize_text_field(wp_unslash($_POST['bar_chart_filter'])); $bar_chart_filter = $bar_chart_filter ? $bar_chart_filter : '0'; $bar_chart_projects = isset($_POST['bar_chart_projects']) ? 7 : sanitize_text_field(wp_unslash($_POST['bar_chart_projects'])); $bar_chart_projects = $bar_chart_projects ? $bar_chart_projects : '0'; $bar_chart_current_user_capability = get_option('bar_chart_current_user_capability'); $bar_chart_current_user_capability = $bar_chart_current_user_capability ? $bar_chart_current_user_capability : 'true'; $bar_chart_hide_completed_status_task = get_option('bar_chart_hide_completed_status_task'); $bar_chart_hide_completed_status_task = $bar_chart_hide_completed_status_task ? $bar_chart_hide_completed_status_task : '0'; $bar_chart_hide_task_statuses_from_frontend = get_option('bar_chart_hide_task_statuses_from_frontend'); $bar_chart_hide_task_statuses_from_frontend = $bar_chart_hide_task_statuses_from_frontend ? $bar_chart_hide_task_statuses_from_frontend : '0'; $bar_chart_hide_task_statuses_from_frontend = $bar_chart_hide_task_statuses_from_frontend ? $bar_chart_hide_task_statuses_from_frontend : '0'; if ( $bar_chart_hide_task_statuses_from_frontend == 'enabled' ) { $bar_chart_hide_task_statuses_from_frontend = 'disabled'; } $filters = array(); $filters['search'] = isset($_POST['search']) ? sanitize_text_field(wp_unslash($_POST['search'])) : ''; $filters['filter'] = isset($_POST['filter']) ? sanitize_text_field(wp_unslash($_POST['filter'])) : ''; $filters['proj_filter'] = isset($_POST['proj_filter']) ? sanitize_text_field(wp_unslash($_POST['proj_filter'])) : ''; $grid_view_filter = $filters; $filters = array( 'COMMA' => wpdm_grid_view_filters() ); $grid_view_filter = $filters; $current_date = wp_date('Y-m-d'); $bar_chart_date = isset($_POST['bar_chart_date']) ? sanitize_text_field(wp_unslash($_POST['bar_chart_date'])) : ''; $bar_chart_where = ''; $bar_chart_where = $bar_chart_date ? " AND bar_chart_date = '$bar_chart_date'" : ''; if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '0'"; } if ( isset($bar_chart) && $bar_chart == 'task_name' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_name = '$bar_chart_name'"; } if ( isset($bar_chart) && $bar_chart == 'task_project' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_project = '$bar_chart_project'"; } if ( isset($bar_chart) && $bar_chart == 'task_priority' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_priority = '$bar_chart_priority'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_status'"; } if ( isset($bar_chart) && $bar_chart == 'task_status' ) { $bar_chart_where = $bar_chart_where . " AND bar_chart_status = '$bar_chart_sta