Webgalamb · Webgalamb · CVE-2018-19515
**Name of the Vulnerable Software and Affected Versions**
Webgalamb versions prior to 7.0
**Description**
The system/ajax.php functionality in Webgalamb is supposed to be restricted to administrators. However, unauthenticated users can access most of these methods by utilizing certain query parameters, specifically `bgsend`, `atment sddd1xGz`, or `xls bgimport`.
**Recommendations**
For Webgalamb versions prior to 7.0, restrict access to the system/ajax.php functionality to prevent unauthenticated users from exploiting the vulnerable query parameters `bgsend`, `atment sddd1xGz`, or `xls bgimport`. Consider temporarily disabling these parameters until a patch is available.