Huy-Ngoc Dau

**Nome do software vulnerável e versões afetadas** Versões do SOPPlanning anteriores à 1.33 **Descrição** Existem várias vulnerabilidades SQL em diversos arquivos PHP, incluindo planning.php, user list.php, projets.php, user groupes.php e groupe list.php. **Recomendações** Para versões anteriores à 1.33, atualize para a versão 1.33 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do SOPlanning anteriores à 1.33 **Descrição** O problema diz respeito a várias vulnerabilidades de Cross-Site Scripting (XSS). Essas vulnerabilidades permitem que usuários mal-intencionados executem código arbitrário por meio do `document.cookie` em `nb mois` e `mb ligness` e do parâmetro GET de depuração em “export.php”. **Recomendações** Para versões anteriores à 1.33, atualize para a versão 1.33 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao endpoint “export.php” e evitar o uso do parâmetro GET de depuração até que um patch seja aplicado.

**Name of the Vulnerable Software and Affected Versions** Soplanning versions 1.32 and earlier **Description** The issue allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. This is because Soplanning generates static links for sharing ICAL calendars with embedded login information. **Recommendations** For Soplanning versions 1.32 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SOPlanning versions 1.32 and earlier **Description** A directory traversal issue exists in the file get contents function, allowing remote attackers to determine the existence of arbitrary files by using a .. (dot dot) in a URL path parameter. **Recommendations** For SOPlanning versions 1.32 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SOPlanning versions 1.32 and earlier **Description** The issue allows remote authenticated users to execute arbitrary PHP code via a crafted database name, given certain conditions such as access to an existing database, permissions to create arbitrary databases, the use of PHP before version 5.2, a down configuration database, or a non-writable smarty/templates c directory. **Recommendations** For SOPlanning versions 1.32 and earlier, update to a version later than 1.32 to resolve the issue. As a temporary workaround, consider restricting database creation permissions and ensuring smarty/templates c is writable, while also updating PHP to version 5.2 or later.