Ahmad Maulana

**Name of the Vulnerable Software and Affected Versions** a-ConMan version 3.2 beta **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `cm basedir` parameter in the common.inc.php file. **Recommendations** For a-ConMan version 3.2 beta, consider restricting access to the `cm basedir` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: P-Book versions 1.17 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the `pb lang` parameter to specific API endpoints, such as "admin.php" and "pbook.php". Recommendations: For P-Book versions 1.17 and earlier, as a temporary workaround, consider restricting access to the "admin.php" and "pbook.php" endpoints until a patch is available. Avoid using the `pb lang` parameter in these affected endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ExBB version 1.9.1 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `exbb[home path]` parameter in various files within the modules directory, including `/birstday/birst.php`, `/birstday/select.php`, `/birstday/profile show.php`, `/newusergreatings/pm newreg.php`, `/punish/p error.php`, `/punish/profile.php`, and `/threadstop/threadstop.php`. This is possible when `register globals` is enabled. **Recommendations** For ExBB version 1.9.1, consider disabling the `register globals` setting to prevent exploitation. Additionally, restrict access to the vulnerable modules, including `birstday`, `newusergreatings`, `punish`, and `threadstop`, until a patch is available. Avoid using the `exbb[home path]` parameter in the affected files.

**Name of the Vulnerable Software and Affected Versions** Turnkey Web Tools PHP Live Helper versions 2.0 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `abs path` parameter. This is a result of a PHP remote file inclusion vulnerability in the global.php file. **Recommendations** For Turnkey Web Tools PHP Live Helper versions 2.0 and earlier, avoid using the `abs path` parameter in the affected global.php file until the issue is resolved. As a temporary workaround, consider restricting access to the global.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Turnkey Web Tools PHP Simple Shop versions 2.0 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `abs path` parameter to various PHP files, including "admin/index.php", "admin/adminindex.php", "admin/adminglobal.php", "admin/login.php", "admin/menu.php", and "admin/header.php". **Recommendations** For Turnkey Web Tools PHP Simple Shop versions 2.0 and earlier, consider restricting access to the `abs path` parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the `abs path` parameter in the specified API endpoints.

**Name of the Vulnerable Software and Affected Versions** iManage CMS version 4.0.12 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `absolute path` parameter to various PHP files, including articles.php, contact.php, displaypage.php, faq.php, mainbody.php, news.php, registration.php, whosOnline.php, and others. This can be achieved by manipulating the `absolute path` parameter in the URL. **Recommendations** For iManage CMS version 4.0.12 and earlier, consider restricting access to the `absolute path` parameter in the affected PHP files until a patch is available. As a temporary workaround, disabling the execution of remote PHP code can help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HTMLArea3 Addon Component (com htmlarea3 xtd-c) for ImageManager version 1.5 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `mosConfig absolute path` parameter in the popups/ImageManager/config.inc.php file. **Recommendations** For HTMLArea3 Addon Component (com htmlarea3 xtd-c) for ImageManager version 1.5, avoid using the `mosConfig absolute path` parameter in the affected API endpoint until the issue is resolved. Restrict access to the popups/ImageManager/config.inc.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Joomla! com hashcash component version 1.2.1 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `mosConfig absolute path` parameter in the server.php file of the Hashcash Component for Joomla!. **Recommendations** For version 1.2.1, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `server.php` file in the com hashcash component to minimize the risk of exploitation. Avoid using the `mosConfig absolute path` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mambo versions 4.5.1 Sitemap component (com sitemap) version 2.0.0 **Description** The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a URL in the `mosConfig absolute path` parameter in the sitemap.xml.php file of the Sitemap component. **Recommendations** For Mambo version 4.5.1, consider disabling the register globals setting to prevent exploitation. For Sitemap component (com sitemap) version 2.0.0, avoid using the `mosConfig absolute path` parameter in the sitemap.xml.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MiniBB Forum versions 1.5a and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `absolute path` parameter to API endpoints such as "components/com minibb.php" or "components/minibb/index.php". **Recommendations** For MiniBB Forum versions 1.5a and earlier, consider restricting access to the `components/com minibb.php` and `components/minibb/index.php` API endpoints until a patch is available. Avoid using the `absolute path` parameter in these endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ExtCalendar version 2.0 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `mosConfig absolute path` parameter in the extcalendar.php file. **Recommendations** For ExtCalendar version 2.0, avoid using the `mosConfig absolute path` parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the extcalendar.php file to minimize the risk of exploitation.