Lihongming

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Nome do Software Vulnerável e Versões Afetadas** itsourcecode Electronic Judging System versão 1.0 **Description** Um problema de injeção de SQL existe no endpoint `/intrams/admin/add judges.php`. Isso ocorre quando o argumento `fname` é manipulado, permitindo que um invasor remoto execute consultas de banco de dados não autorizadas. **Recommendations** Atualize o itsourcecode Electronic Judging System para uma versão que corrija este problema. Como mitigação temporária, restrinja o acesso ao endpoint `/intrams/admin/add judges.php` ou evite usar o parâmetro `fname` até que uma correção seja aplicada.