Security Vulnerabilities

[Sl33pi]

Since I cannot find a vulnerability disclosure program for MageSolutions, and this github repository is linked on their official page, I would like to warn everyone that this module is vulnerable on multiple accounts:

1. Bad Access Control (BAC)
2. XSS (Stored & Reflected)
3. Remote Code Execution (RCE)
4. CMS Page Injection

I would strongly suggest thinking twice before using this module. I have PoCs for all of the previously mentioned vulnerabilities for magento 2.3.x and 2.4.x, but I am going to refrain from posting them publicly here.

Whoever from MageSolution is responsible for maintaining this module, please contact me if you would like to view the PoCs.