VOD Infomaniak Security & Risk Analysis

The "vod-infomaniak" plugin v1.5.13 exhibits a concerning security posture, primarily due to a significant number of unprotected AJAX handlers. The static analysis reveals 10 AJAX handlers with a staggering 8 lacking any form of authentication checks. This creates a large attack surface that could be exploited by unauthenticated users to trigger plugin functionality. Furthermore, the taint analysis shows 8 flows with unsanitized paths, and while no critical or high severity taint flows were detected in this specific analysis, the presence of 8 unsanitized paths is a significant indicator of potential vulnerabilities, especially when combined with the unprotected AJAX endpoints. This suggests a high risk of cross-site scripting (XSS) or other injection attacks if user-supplied data is not properly validated and sanitized before being used in dynamic contexts.

The vulnerability history further compounds these concerns. With a total of 4 known CVEs, including one high-severity and three medium-severity issues, the plugin has a history of security flaws. Common vulnerability types like Cross-Site Scripting, Missing Authorization, and Cross-Site Request Forgery point to recurring weaknesses in how the plugin handles user input and manages access control. The fact that the last vulnerability was dated September 2025 suggests that while there are no currently unpatched CVEs for this version, the plugin has had recent security issues that may indicate a pattern of development that is not prioritizing robust security practices.

In conclusion, while the plugin shows some positive signs like the absence of dangerous functions and a moderate use of prepared statements for SQL queries, the overwhelming number of unprotected AJAX endpoints and the concerning taint analysis results, coupled with a history of multiple vulnerabilities, present a significant risk. The lack of proper authorization on a majority of its entry points is a critical flaw that needs immediate attention. The output escaping is also a weak point, with only 38% properly escaped, increasing the likelihood of XSS vulnerabilities when combined with unsanitized input.