Parnuski

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it was possible to create PDF templates containing `<img>` tags. When a PDF is exported using these templates, the content is rendered server-side, leading to a Server-Side Request Forgery (SSRF). Specifically, a crafted `<img>` tag, such as `<img src=http://{burp collaborator url}>`, causes the server to make a request to the specified URL. **Recommendations** Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

**Nome do Software Vulnerável e Versões Afetadas** Versões do SuiteCRM anteriores à 7.14.7 **Descrição** O SuiteCRM é uma aplicação de software de Gerenciamento de Relacionamento com o Cliente (CRM) de código aberto e pronta para o ambiente corporativo. O módulo InboundEmail permite a execução arbitrária de consultas no banco de dados de backend, levando à injeção de SQL. Isso pode ter implicações de amplo alcance na confidencialidade, integridade e disponibilidade, pois os dados do banco de dados podem ser recuperados, modificados ou totalmente removidos. **Recomendações** Atualize o SuiteCRM para a versão 7.14.7.

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1 Description: The issue affects Opal, the core database application for biobanks or epidemiological studies. When copying any parent directory to a folder in the "/temp/" directory, all files in that parent directory are copied, including files that the user should not have access to. This means any user can exploit this to reveal all files in the Opal filesystem. Low-privilege users, such as DataShield users, can retrieve the files of other users. Recommendations: For versions prior to 5.1.1, update to version 5.1.1, which includes a patch for this issue. As a temporary workaround, consider restricting access to the "/temp/" directory to minimize the risk of exploitation. Avoid using the `/temp/` directory for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1 Description: The issue concerns insufficient protections against cross-site request forgery (CSRF) in the Opal application. The application checks the referrer header and returns a 403 error if it is invalid. However, this protection can be bypassed by dropping the referrer header from CSRF requests using `<meta name="referrer" content="never">`. Recommendations: For versions prior to 5.1.1, update to version 5.1.1 to resolve the issue.