Creastery

**Nome do software vulnerável e versões afetadas** Versões do Shopware anteriores à 6.5.8.13 Versões do Shopware anteriores à 6.6.5.1 **Descrição** O problema diz respeito à variável `context` injetada em praticamente qualquer modelo Twig, permitindo o acesso às informações atuais de idioma e moeda. O objeto context pode alterar o escopo do Context como um helper com uma função chamável, que pode ser chamada a partir do Twig. Isso permite chamar qualquer função/método PHP estaticamente chamável a partir do Twig. A exploração requer acesso à Administração, utilizando modelos de e-mail ou scripts de aplicativos. **Recomendações** Atualize para o Shopware 6.5.8.13 para receber um patch. Atualize para o Shopware 6.6.5.1 para receber um patch. Para versões mais antigas, como 6.1, 6.2, 6.3 e 6.4, medidas de segurança correspondentes estão disponíveis por meio de um plugin.

**Nome do software vulnerável e versões afetadas** Versões do Shopware anteriores à 6.6.5.1 Versões do Shopware anteriores à 6.5.8.13 **Descrição** O problema diz respeito a uma nova tag Twig `sw silent feature call` no Shopware, que silencia mensagens de depreciação. Essa tag aceita um parâmetro de string para o nome do sinalizador de recurso a ser silenciado, mas o parâmetro não é escapado corretamente, permitindo a execução de código. **Recomendações** Atualize para o Shopware 6.6.5.1 para receber um patch. Atualize para o Shopware 6.5.8.13 para receber um patch. Para versões mais antigas, como 6.2, 6.3 e 6.4, instale um plugin que forneça medidas de segurança correspondentes para mitigar o problema.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the `/main/webservices/additional webservices.php` endpoint. This allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write. **Recommendations** For versions prior to 1.11.20, update to a version that contains a fix for this issue to prevent path traversal and subsequent remote code execution. As a temporary workaround, consider restricting access to the `/main/webservices/additional webservices.php` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue is related to improper sanitisation in the `main/inc/lib/fileUpload.lib.php` file, which allows unauthenticated attackers to bypass file upload security protections. This can lead to remote code execution via the uploading of a `.htaccess` file. The vulnerability may be exploited by privileged attackers or chained with other vulnerabilities to achieve remote code execution. **Recommendations** For versions prior to 1.11.20, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `fileUpload.lib.php` file or disabling the file upload functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php`. This has been exploited in real-world incidents, such as the PermX machine on HackTheBox, where attackers used subdomain enumeration to discover a vulnerable Chamilo LMS instance, and then abused a bash script with sudo privileges to gain root access. **Recommendations** For versions prior to 1.11.24, update to version 1.11.24 or later to resolve the issue. As a temporary workaround, consider disabling the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` until a patch is available. Restrict access to the `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` file to minimize the risk of exploitation. Avoid using the big file upload functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns improper neutralisation of special characters, allowing command injection in the `main/lp/openoffice presentation.class.php` file. This enables users who are permitted to upload Learning Paths to obtain remote code execution. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `main/lp/openoffice presentation.class.php` file or disabling the upload of Learning Paths until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue concerns command injection in the `/main/webservices/additional webservices.php` endpoint, allowing unauthenticated attackers to achieve remote code execution due to improper neutralization of special characters. This is a bypass of a previously known issue. **Recommendations** For versions prior to 1.11.20, as a temporary workaround, consider restricting access to the `/main/webservices/additional webservices.php` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/dropbox.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `/main/inc/ajax/dropbox.ajax.php` endpoint to prevent file uploads.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/exercise.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution via unrestricted file uploads.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue allows authenticated attackers with a learner role to achieve remote code execution. This is possible due to an unrestricted file upload in the `/main/inc/ajax/work.ajax.php` endpoint, which enables the uploading of PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `/main/inc/ajax/work.ajax.php` endpoint to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns a command injection in the `main/lp/openoffice text document.class.php` file, allowing users who can upload Learning Paths to achieve remote code execution. This is due to the improper neutralization of special characters. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent command injection and potential remote code execution. As a temporary workaround, consider restricting the upload of Learning Paths to trusted users or disabling the vulnerable `openoffice text document.class.php` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/document.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution via unrestricted file uploads.

**Name of the Vulnerable Software and Affected Versions** NodeBB versions <= 2.8.10 **Description** The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively. **Recommendations** For NodeBB versions <= 2.8.10, update to a version greater than 2.8.10 to resolve the issue. As a temporary workaround, consider restricting the use of Socket.IO messages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Shopware versions 6.4.20.0 and earlier, and 6.5.0.0-rc1 through 6.5.0.0-rc4 **Description** The software is susceptible to a Server-side Template Injection (SSTI) issue within the Twig environment. This allows remote attackers, with access to a Twig environment lacking the Sandbox extension, to bypass validation checks in the `ShopwareCoreFrameworkAdapterTwigSecurityExtension`. By utilizing fully-qualified names supplied as an array of strings when referencing callables, attackers can invoke arbitrary PHP functions and potentially execute arbitrary code or commands. The issue stems from insufficient checks on PHP Closures passed as strings or arrays, which were not validated against an allow list. **Recommendations** Shopware versions 6.4.20.0 and earlier should be upgraded to version 6.4.20.1 to resolve this issue. Shopware versions 6.5.0.0-rc1 through 6.5.0.0-rc4 should be upgraded to a patched version. For older versions of 6.1, 6.2, and 6.3, utilize the available security plugin as a mitigation.

**Nome do software vulnerável e versões afetadas** Hancom Office versão 9.6.1.7634 **Descrição** A vulnerabilidade permite um ataque do tipo “use-after-free” por meio de um arquivo .docx malicioso, afetando especificamente o componente tfo common no HwordApp.dll. **Recomendações** Para o Hancom Office versão 9.6.1.7634, no momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.