Florian Walter

**Nome do software vulnerável e versões afetadas** SocialMediaWebsite versão 1.0.1 **Descrição** Uma vulnerabilidade de cross-site scripting (XSS) refletido permite que invasores injetem código JavaScript malicioso no navegador da vítima por meio do parâmetro `poll` no arquivo “poll.php”. **Recomendações** Para o SocialMediaWebsite versão 1.0.1, considere restringir o acesso ao endpoint “poll.php” até que uma correção esteja disponível. Como solução temporária, evite usar o parâmetro `poll` no endpoint afetado para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** KLiK SocialMediaWebsite versão 1.0.1 **Descrição** Uma vulnerabilidade de cross-site scripting (XSS) refletida pode permitir que invasores remotos executem código JavaScript arbitrário no navegador da web de um usuário. Isso pode ser feito incluindo uma carga maliciosa nos parâmetros `selector` ou `validator` do endpoint “create-new-pwd.php”. **Recomendações** Para o KLiK SocialMediaWebsite versão 1.0.1, considere desativar o endpoint `create-new-pwd.php` até que uma correção esteja disponível. Restrinja o acesso aos parâmetros `selector` e `validator` para minimizar o risco de exploração. Evite usar esses parâmetros no endpoint afetado até que o problema seja resolvido. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas** zhimengzhe iBarn versão 1.5 **Descrição** Uma vulnerabilidade de cross-site scripting (XSS) refletido permite que invasores injetem JavaScript malicioso no navegador da vítima por meio do parâmetro `search` em “offer.php”. Esse problema permite que invasores executem scripts maliciosos no contexto do navegador da vítima, podendo levar a ações não autorizadas ou roubo de dados. **Recomendações** Para o zhimengzhe iBarn versão 1.5, considere desativar a funcionalidade de pesquisa em offer.php até que um patch esteja disponível para impedir a exploração da vulnerabilidade XSS refletida. Restrinja o acesso à página offer.php para minimizar o risco de exploração. Evite usar o parâmetro `search` no endpoint da API afetado até que o problema seja resolvido. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões 1.0.0 a 1.0.1 do WebAPI Boilerplate da FullStackHero **Descrição** Uma falha de injeção no cabeçalho do host na função de recuperação de senha permite que invasores divulguem o token de redefinição de senha por meio de uma solicitação maliciosa. **Recomendações** Para as versões 1.0.0 e 1.0.1, como solução temporária, considere desativar a função de recuperação de senha até que um patch esteja disponível. Restrinja o acesso ao endpoint de recuperação de senha para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** @perfood/couch-auth versões <= 0.20.0 **Descrição** Existe uma vulnerabilidade de injeção de cabeçalho de host no pacote NPM @perfood/couch-auth. Ao enviar um cabeçalho de host especialmente criado na solicitação de recuperação de senha, é possível enviar links de redefinição de senha aos usuários que, uma vez clicados, redirecionam para um servidor controlado pelo invasor e, assim, vazam o token de redefinição de senha. Isso pode permitir que um invasor redefina as senhas de outros usuários e assuma o controle de suas contas. **Recomendações** Para versões do @perfood/couch-auth <= 0.20.0, considere desativar o recurso de recuperação de senha até que um patch esteja disponível. Restrinja o acesso à solicitação de recuperação de senha para minimizar o risco de exploração. Evite usar o cabeçalho de host na solicitação de recuperação de senha até que o problema seja resolvido. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** A reflected cross-site scripting issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into any of the `calendar id`, `school date`, `month`, or `year` parameters in 'CalendarModal.php'. **Recommendations** For version 9.0, consider disabling access to 'CalendarModal.php' until a patch is available to prevent exploitation. Restrict input for the `calendar id`, `school date`, `month`, and `year` parameters to minimize the risk of arbitrary JavaScript execution.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** The issue allows remote attackers to read arbitrary files via a directory traversal vulnerability in the `filename` parameter of the "DownloadWindow.php" endpoint. **Recommendations** For version 9.0, consider restricting access to the "DownloadWindow.php" endpoint until a patch is available, and avoid using the `filename` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** The issue concerns a broken access control vulnerability in the database backup functionality. When an admin generates a database backup, it is stored in the web root with a filename that can be easily guessed, such as "opensisBackup<date>.sql". This file can be accessed by any unauthenticated actor and contains a dump of the whole database, including password hashes. **Recommendations** For openSIS Classic version 9.0, consider restricting access to the database backup files until a proper fix is available. As a temporary workaround, avoid using the default filename format for database backups and store them outside the web root to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** A reflected cross-site scripting (XSS) issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into the `include` parameter in the "ForExport.php" endpoint. **Recommendations** For openSIS Classic version 9.0, consider disabling access to the "ForExport.php" endpoint until a patch is available, or restrict the `include` parameter to prevent malicious input.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** A reflected cross-site scripting issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into the `ajax` parameter in the 'ParentLookup.php' endpoint. **Recommendations** For openSIS Classic version 9.0, consider disabling access to the 'ParentLookup.php' endpoint until a patch is available, or restrict the `ajax` parameter to prevent malicious input.

**Name of the Vulnerable Software and Affected Versions** openSIS Classic version 9.0 **Description** The issue allows an unauthenticated remote attacker to access any student's files. This is achieved by visiting the "/assets/studentfiles/<studentId>-<filename>" API endpoint, where `studentId` and `filename` are variables that can be manipulated to access different files. **Recommendations** For openSIS Classic version 9.0, restrict access to the "/assets/studentfiles/<studentId>-<filename>" API endpoint to prevent unauthorized file access. Consider implementing proper authentication and authorization mechanisms to ensure that only authorized users can access student files.

**Name of the Vulnerable Software and Affected Versions** OpenSIS Classic Community Edition version 9.0 **Description** The issue lacks cross-site request forgery (CSRF) protection throughout the application, which may allow an attacker to trick an authenticated user into performing any kind of state-changing request. **Recommendations** For OpenSIS Classic Community Edition version 9.0, consider implementing CSRF protection mechanisms to prevent state-changing requests from being tricked by an attacker. As a temporary workaround, restrict access to sensitive areas of the application that could be exploited through CSRF attacks until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** Economizzer version 0.9-beta1 **Description** A host header injection issue exists, allowing an attacker to send password reset links to users that lead to an attacker-controlled server, thus leaking the password reset token. This enables the attacker to reset other users' passwords by sending a specially crafted host header in the reset password request. **Recommendations** For Economizzer version 0.9-beta1, consider disabling the password reset functionality until a patch is available to prevent exploitation of the host header injection vulnerability. Restrict access to the reset password request to minimize the risk of attackers sending specially crafted host headers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gugoan Economizzer version 0.9-beta1 gugoan Economizzer commit 3730880 (April 2023) **Description** The issue is related to Clickjacking, also known as a "UI redress attack", where an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. This allows the attacker to "hijack" clicks meant for their page and route them to another page, most likely owned by another application, domain, or both. **Recommendations** For gugoan Economizzer version 0.9-beta1, consider implementing framebusting techniques to prevent the page from being framed by other sites. For gugoan Economizzer commit 3730880 (April 2023), as a temporary workaround, consider restricting access to sensitive functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gugoan Economizzer versions 0.9-beta1 gugoan Economizzer commit 3730880 **Description** An Insecure Direct Object Reference (IDOR) vulnerability allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the `Id` of the attachment. **Recommendations** For gugoan Economizzer version 0.9-beta1, consider restricting access to cash book entry attachments until a patch is available. For gugoan Economizzer commit 3730880, avoid using the attachment `Id` in unauthenticated requests to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gugoan Economizzer version 0.9-beta1 **Description** The issue concerns a user enumeration vulnerability in the login and forgot password functionalities. The application reacts differently when a user or email address is valid, and when it's not, potentially allowing an attacker to determine whether a user or email address is valid or brute force valid usernames and email addresses. **Recommendations** For version 0.9-beta1, consider temporarily disabling the login and forgot password functionalities until a patch is available. Restrict access to these features to minimize the risk of exploitation. Avoid using the affected functionalities in the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gugoan Economizzer versions 0.9-beta1 and commit 3730880 (April 2023) **Description** A SQL injection vulnerability exists in the cash book feature of gugoan Economizzer, specifically in the `category id` parameter, which is used to list accomplishments by category. This vulnerability allows for SQL injection attacks. **Recommendations** For gugoan Economizzer version 0.9-beta1, consider disabling the feature to list accomplishments by category until a patch is available. For gugoan Economizzer commit 3730880 (April 2023), restrict access to the `category id` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Economizzer version 0.9-beta1 **Description** A remote code execution vulnerability exists via an insecure file upload. A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry, allowing them to execute arbitrary commands. **Recommendations** For Economizzer version 0.9-beta1, consider disabling the file upload feature when adding new cash book entries until a patch is available. Restrict access to the attachment upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 Visual Project Explorer version 1.0 **Description** A reflected cross-site scripting (XSS) issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the `service` parameter in the 'headstart snapshot.php' endpoint. **Recommendations** For OpenKnowledgeMaps Head Start versions 4, 5, 6, 7, consider disabling access to the 'headstart snapshot.php' endpoint until a patch is available. For Visual Project Explorer version 1.0, restrict the use of the `service` parameter in the 'headstart snapshot.php' endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `service` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** msaad1999's PHP-Login-System version 2.0.1 **Description** A reflected cross-site scripting (XSS) issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the `validator` parameter in the "/reset-password" API endpoint. **Recommendations** For version 2.0.1, as a temporary workaround, consider disabling the `/reset-password` endpoint until a patch is available. Restrict access to the `validator` parameter in the `/reset-password` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.