漏洞概述 该漏洞涉及WordPress插件“Cost Calculator Builder”中的文件 。具体路径为 。漏洞可能存在于插件的某些功能中，导致潜在的安全风险。 影响范围 插件名称: Cost Calculator Builder 版本: 4.0.5 受影响文件: 修复方案 1. 更新插件: 建议用户立即更新到最新版本的Cost Calculator Builder插件，以修复已知漏洞。 2. 代码审查: 对插件代码进行详细审查，特别是 文件，确保没有未授权访问或数据泄露的风险。 3. 安全配置: 检查并加强服务器和数据库的安全配置，防止潜在的攻击。 POC代码 以下是 文件中的相关代码片段： ```php setPaymentGatewayOrder( $_GET['token'], $calc_id ); } // If Language not set, use as default / if ( ! isset( $language ) ) { $language = 'en'; } if ( ! isset( $translations ) ) { $translations = array(); } if ( ! isset( $settings ) ) { $settings = UBuilderWCData::get_calc_single_settings( $calc_id ); } if ( ! isset( $general_settings ) ) { $general_settings = UBuilderWCData::get_calc_global_settings(); } $calc_sync = $cb_sync_settings->get_general_settings( $general_settings, $general_settings, true ); $settings = $calc_sync['settings']; $general_settings = $calc_sync['general_settings']; if ( ! empty( $settings ) && isset( $settings[0] ) && isset( $settings[0]['general'] ) ) { $settings = $settings[0]; } if ( empty( $settings['general'] ) ) { $settings['general'] = UBuilderWCData::get_settings_data(); } $settings['calc_id'] = $calc_id; $settings['title'] = get_post_meta( $calc_id, 'cb-name', true ); if ( count( $settings['formFields'] ) ) { foreach ( $settings['formFields'] as $key => $field ) { if ( ! empty( $field['value'] ) ) { $settings['formFields'][ $key ]['value'] = $field['value']; } } } if ( ! empty( $general_settings['payment_gateway']['cards']['use_on_all'] ) && ! empty( $general_settings['payment_gateway']['cards']['card_payments']['razorpay']['enable'] ) ) { $settings['payment_gateway']['cards']['card_payments']['razorpay']['enable'] = $general_settings['payment_gateway']['cards']['card_payments']['razorpay']['enable']; $settings['payment_gateway']['cards']['card_payments']['razorpay']['keyId'] = $general_settings['payment_gateway']['cards']['card_payments']['razorpay']['keyId']; $settings['payment_gateway']['cards']['card_payments']['razorpay']['secretKey'] = $general_settings['payment_gateway']['cards']['card_payments']['razorpay']['secretKey']; } if ( ! empty( $general_settings['payment_gateway']['cards']['use_on_all'] ) && ! empty( $general_settings['payment_gateway']['cards']['card_payments']['stripe']['enable'] ) ) { $settings['payment_gateway']['cards']['card_payments']['stripe']['enable'] = $general_settings['payment_gateway']['cards']['card_payments']['stripe']['enable']; $settings['payment_gateway']['cards']['card_payments']['stripe']['publishableKey'] = $general_settings['payment_gateway']['cards']['card_payments']['stripe']['publishableKey']; $settings['payment_gateway']['cards']['card_payments']['stripe']['secretKey'] = $general_settings['payment_gateway']['cards']['card_payments']['stripe']['secretKey']; } if ( ! empty( $general_settings['payment_gateway']['cash_payment']['use_on_all'] ) ) { $settings['payment_gateway']['cash_payment']['label'] = $general_settings['payment_gateway']['cash_payment']['label']; $settings['payment_gateway']['cash_payment']['form'] = $general_settings['payment_gateway']['cash_payment']['form']; } if ( ! empty( $general_settings['payment_gateway']['paypal']['use_on_all'] ) ) { $general_settings['payment_gateway']['paypal']['integration_type'] = $general_settings['payment_gateway']['paypal']['integration_type']; $general_settings['payment_gateway']['paypal']['currency_code'] = $general_settings['payment_gateway']['paypal']['currency_code']; $settings['payment_gateway']['paypal']['integration_type'] = $general_settings['payment_gateway']['paypal']['integration_type']; $settings['payment_gateway']['paypal']['currency_code'] = $general_settings['payment_gateway']['paypal']['currency_code']; $settings['payment_gateway']['paypal']['mode'] = $general_settings['payment_gateway']['paypal']['mode']; $settings['payment_gateway']['paypal']['client_id'] = $general_settings['payment_gateway']['paypal']['client_id']; $settings['payment_gateway']['paypal']['client_secret'] = $general_settings['payment_gateway']['paypal']['client_secret']; } if ( ! empty( $settings['formFields'] ) ) { $settings['formFields']['body'] = str_replace( '', "\n", $settings['formFields']['body'] ); } if ( ! empty( $settings['thankYouPage'] ) ) { $page_id = $settings['thankYouPage']['page_id']; $body = get_post_field( 'post_content', $page_id ); $body = wp_kses_post( $body ); if ( false === $body ) { $body = ''; } $body = wp_kses_post( $body ); $settings['thankYouPage']['page_url'] = get_permalink( $settings['thankYouPage']['page_id'] ); } if ( ! empty( $settings['formFields'] ) && ! empty( $settings['formFields']['terms'] ) ) { $settings['formFields']['terms'] = apply_filters( 'cb_custom_terms', $settings['formFields']['terms'] ); } if ( ! empty( $general_settings['formFields']['summary_display']['enable'] ) ) { $settings['formFields']['summary_display']['enable'] = true; } if ( ! empty( $general_settings['formFields']['summary_display']['enable'] ) ) { $settings['formFields']['summary