Acorzo1983

**Nome do Software Vulnerável e Versões Afetadas** Piwigo versões anteriores a 16.3.0 **Descrição** Existe um problema no método de API do Web Service `pwg.users.getList` onde o parâmetro `filter` é concatenado diretamente em uma consulta SQL sem a sanitização adequada. Isso permite que administradores autenticados executem comandos SQL arbitrários via SQL Injection, uma técnica usada para interferir nas consultas que um aplicativo faz ao seu banco de dados. **Recomendações** Atualize para a versão 16.3.0. Evite usar o parâmetro `filter` no método de API `pwg.users.getList` até que a atualização seja aplicada.

**Name of the Vulnerable Software and Affected Versions** Wallos versions 4.6.0 and below **Description** Wallos is a self-hostable personal subscription tracker susceptible to a Server-Side Request Forgery (SSRF) issue in the subscription and payment logo/icon upload functionality. The application validates the IP address of a provided URL, but allows HTTP redirects, enabling an attacker to bypass IP validation and access internal resources, including cloud instance metadata endpoints. The `getLogoFromUrl()` function uses `FILTER FLAG NO PRIV RANGE | FILTER FLAG NO RES RANGE` to validate the URL, but the cURL request is configured with `CURLOPT FOLLOWLOCATION = true` and `CURLOPT MAXREDIRS = 3`, allowing redirects without re-validation of the destination IP. **Recommendations** Update to version 4.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** ZoneMinder versions 1.36.37 and below ZoneMinder versions 1.37.61 through 1.38.0 **Description** ZoneMinder is a free, open source closed-circuit television software application. A second-order SQL Injection issue exists in the `web/ajax/status.php` file within the `getNearEvents()` function. Event field values, specifically `Name` and `Cause`, are initially stored securely using parameterized queries. However, these values are later retrieved and directly concatenated into SQL `WHERE` clauses without proper escaping, allowing for potential exploitation. An authenticated user with Events edit and view permissions can leverage this to execute arbitrary SQL queries. **Recommendations** ZoneMinder versions 1.36.37 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ZoneMinder versions 1.37.61 through 1.38.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.