Pico
Monthly
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.