YOOtheme Pro vulnerabilities

Joomla extension YOOtheme Pro versions 5.0.0–5.0.52 contains an unauthenticated remote code execution vulnerability. The publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature, allowing an attacker to reuse a signature from a legitimate public image URL, inject additional operations, traverse out of the cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

YOOtheme Pro for Joomla versions 1.0.0-5.0.41 has a missing access check, allowing users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions. This is an information disclosure for authenticated, privileged users.

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.

Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.