Tarkus

**Name of the Vulnerable Software and Affected Versions** b2evolution versions 1.8.5 through 1.9 beta **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `inc path` parameter. This is a result of a PHP remote file inclusion vulnerability in the inc/CONTROL/import/import-mt.php file. **Recommendations** For b2evolution versions 1.8.5 through 1.9 beta, consider restricting access to the `inc/CONTROL/import/import-mt.php` file to minimize the risk of exploitation. Avoid using the `inc path` parameter in the affected import-mt.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** b2evolution versions 1.8.2 through 1.9 beta **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `app name` parameter in files such as ` 404 not found.page.php`, ` 410 stats gone.page.php`, and ` referer spam.page.php` in the `inc/VIEW/errors/` directory, the `baseurl` parameter in ` 404 not found.page.php`, and the `ReqURI` parameter in ` referer spam.page.php`. **Recommendations** For b2evolution versions 1.8.2 through 1.9 beta, consider disabling the `app name`, `baseurl`, and `ReqURI` parameters in the affected files until a patch is available. Restrict access to the `inc/VIEW/errors/` directory to minimize the risk of exploitation. Avoid using the `app name` parameter in ` 404 not found.page.php`, ` 410 stats gone.page.php`, and ` referer spam.page.php`, the `baseurl` parameter in ` 404 not found.page.php`, and the `ReqURI` parameter in ` referer spam.page.php` in the affected API endpoints until the issue is resolved.