FireBox Popups – Increase Sales and Grow Your Email List

An Author can reach SQL injection in FormDisplayCondition on sites that retained an older Campaign Role Access grant of edit_fireboxes to edit_posts users. Fresh installations from 3.1.10 use Administrator-only access, so the lower-privilege path depends on preserved configuration. The export does not name the injected parameter. Affected versions: <= 3.1.13.

FireBox through 3.1.10 stores unsanitized PHP condition-rule values through the firebox_meta REST endpoint. When the value function evaluates them, the regex blacklist in Executer::allowedToRun() fails to prevent dangerous function calls, allowing server-side code execution. On sites upgraded from a version before 3.1.10, Migrator::preserveCampaignRoleAccess() grants Authors edit_fireboxes and publish_fireboxes, making those Author accounts able to reach the vulnerable functionality.

FireBox Popups – Increase Sales and Grow Your Email List is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.1.7.

FireBox is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.