Besim Altinok

**Name of the Vulnerable Software and Affected Versions** Edimax EW-7438RPn version 1.13 **Description** The Edimax EW-7438RPn version 1.13 contains a flaw that allows disclosure of WiFi network configuration details. An attacker can access the `wlencrypt wiz.asp` file to retrieve sensitive information, including the WiFi network name and the plaintext password stored in device configuration variables. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netis E1+ version 1.2.32533 **Description** An information disclosure issue exists that allows unauthenticated attackers to retrieve WiFi passwords. Attackers can send a GET request to the ''netcore get.cgi'' endpoint to extract sensitive network credentials, including SSID and WiFi passwords, in plain text. The `netcore get.cgi` endpoint is the point of access for this information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Edimax EW-7438RPn version 1.13 **Description** The Edimax EW-7438RPn version 1.13 contains a cross-site request forgery issue in the MAC filtering configuration interface. An attacker can create malicious web pages to deceive users into adding unauthorized MAC addresses to the device’s filtering rules without their knowledge. The vulnerability allows attackers to manipulate the device's MAC filtering settings. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the MAC filtering feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Booked Scheduler versão 2.7.7 **Description** Um problema de salto de diretório existe no script 'manage email templates.php'. Administradores autenticados podem explorar o parâmetro `tn` para ler arquivos fora do diretório pretendido usando técnicas de salto de caminho de diretório, que é um método usado para acessar arquivos e diretórios armazenados fora da pasta raiz da web. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** i-doit Open Source CMDB versão 1.14.1 **Description** Um problema no módulo de importação permite que atacantes autenticados excluam arquivos arbitrários do sistema de arquivos do servidor. Isso é feito enviando uma solicitação POST para o módulo de importação e manipulando o parâmetro `delete import` com um nome de arquivo malicioso. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** webTareas versão 2.0.p8 **Description** O componente de administração 'print layout.php' contém uma falha que permite a atacantes autenticados excluir arquivos arbitrários no servidor. Isso é feito manipulando o parâmetro `atttmp1` por meio de um mecanismo de exclusão de arquivos não autenticado. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Nome do Software Vulnerável e Versões Afetadas** webERP versão 4.15.1 **Description** Um problema de acesso a arquivos não autenticado permite que atacantes remotos baixem arquivos de backup do banco de dados. Atacantes podem acessar diretamente arquivos de backup gerados localizados no diretório 'companies/weberp/' solicitando o arquivo `Backup [timestamp].sql.gz`. **Recommendations** Para a versão 4.15.1, restrinja o acesso ao diretório 'companies/weberp/' para evitar downloads não autorizados de arquivos de backup.

**Name of the Vulnerable Software and Affected Versions** School ERP Pro version 1.0 **Description** School ERP Pro version 1.0 has a flaw that allows attackers to read arbitrary files without needing to log in. This is possible by manipulating the `document` parameter within the 'download.php' file. By providing directory traversal paths, attackers can gain access to sensitive configuration files, potentially revealing system credentials and configuration information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** School ERP Pro version 1.0 **Description** School ERP Pro version 1.0 contains a SQL injection issue in the `es messagesid` parameter. Attackers can manipulate database queries through GET requests by injecting crafted SQL statements. This could allow attackers to extract, modify, or delete database information. The vulnerable parameter is accessible via GET requests. **Recommendations** Apply a fix for School ERP Pro version 1.0 to address the SQL injection issue in the `es messagesid` parameter.

**Name of the Vulnerable Software and Affected Versions** School ERP Pro version 1.0 **Description** School ERP Pro 1.0 has a file upload issue that permits students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts via the message attachment feature, leading to remote code execution on the server. The vulnerable feature is the message attachment functionality, which does not properly validate uploaded files. The affected API endpoint is the messaging system's file upload function. The vulnerable parameter is the file attachment, `file`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Maian Support Helpdesk version 4.3 **Description** The software contains a cross-site request forgery condition that permits attackers to create administrative accounts without needing to authenticate. Attackers can construct malicious HTML forms to add administrative users and upload PHP files. The file upload through the FAQ attachment system has no restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netis E1+ version 1.2.32533 **Description** The Netis E1+ device version 1.2.32533 has a hardcoded root account that allows unauthenticated attackers to access the device using predefined credentials. Attackers can exploit the embedded root account with a crackable password to obtain full administrative access to the network device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Nome do Software Vulnerável e Versões Afetadas: Firmware do Edimax EW-7438RPn Mini versões 1.13 e anteriores Descrição: Um atacante remoto autenticado pode explorar uma vulnerabilidade de injeção de comando do sistema operacional por meio do manipulador de formulário syscmd.asp, especificamente através do parâmetro "sysCmd" no endpoint "/goform/formSysCmd". Isso permite a execução de comandos de shell arbitrários com privilégios de usuário root. Recomendações: Para as versões 1.13 e anteriores do firmware do Edimax EW-7438RPn Mini, considere desativar o acesso ao endpoint "/goform/formSysCmd" até que um patch esteja disponível. Restrinja o uso do parâmetro `sysCmd` no manipulador de formulário syscmd.asp para minimizar o risco de exploração.

Name of the Vulnerable Software and Affected Versions: Edimax EW-7438RPn versions 1.13 and prior Description: An OS command injection issue exists, allowing an authenticated attacker to inject shell commands and achieve arbitrary command execution as the root user. This is due to the improper handling of user-supplied input to the `command` parameter in the "/goform/mp" endpoint. Recommendations: For Edimax EW-7438RPn versions 1.13 and prior, as a temporary workaround, consider restricting access to the "/goform/mp" endpoint until a patch is available. Avoid using the `command` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.