Description
XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.
Problem types
Improper Control of Generation of Code ('Code Injection')
Product status
Credits
Cyanide
References
xenforo.com/...-3-7-released-includes-security-fixes.232121/ (XenForo 2.3.7 Released (Includes Security Fixes))
www.vulncheck.com/...template-method-call-restriction-bypass (VulnCheck Advisory: XenForo Template Method Call Restriction Bypass)