Description
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
Remediation
References
Related Vulnerabilities
WordPress Plugin BulletProof Security Cross-Site Scripting (.52.4)
WordPress Plugin 3DPrint Lite Arbitrary File Upload (1.9.1.4)
WordPress Plugin WP-Polls Cross-Site Scripting (2.60)
Joomla! Core 3.x.x Security Bypass (3.1.0 - 3.8.12)
WordPress Plugin Japanized For WooCommerce Cross-Site Scripting (2.5.6)