Bilal Güneş

**Name of the Vulnerable Software and Affected Versions** Industrial Application Software IAS Canias ERP version 8.03 **Description** Improper authentication exists in the RMI Interface component. A remote attacker can manipulate the `sessionId` argument within the `doAction()` function to bypass authentication mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Industrial Application Software IAS Canias ERP version 8.03 **Description** A path traversal issue exists in the RMI Interface component. A remote attacker can exploit this by manipulating the `m strSourceFileName` argument within the `iasRequestFileEvent()` function. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the intended folder by using special character sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the RMI Interface component or the `iasRequestFileEvent()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IAS Canias ERP version 8.03 **Description** An issue in the Java RMI Session Management component allows for improper authentication. This can be triggered remotely via the `iasServerRemoteInterface.doAction()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Industrial Application Software IAS Canias ERP version 8.03 **Description** A flaw in the RMI Interface component allows for remote OS command injection. This occurs through the manipulation of the `troiaCode` argument within the `Runtime.getRuntime.exec()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IAS Canias ERP version 8.03 **Description** An improper authorization issue exists in the RMI Interface component. A remote attacker can manipulate the `iasGetServerInfoEvent()` function to bypass authorization controls. **Recommendations** As a temporary workaround, consider restricting access to the `iasGetServerInfoEvent()` function within the RMI Interface component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IAS Canias ERP version 8.03 **Description** A remote issue exists in the Login RMI Interface component within the `doAction()` function. A specific manipulation of this function leads to an observable response discrepancy. Exploitation is considered difficult and requires a high degree of complexity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IAS Canias ERP version 8.03 **Description** A remote attack can be performed against the JNLP Deployment Endpoint component. Manipulation of an unknown function within this component can lead to the use of a hard-coded cryptographic key, which is a fixed secret used for encryption or authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Industrial Application Software IAS Canias ERP version 8.03 **Description** An issue exists in the Login RMI Interface component where manipulation of the `clientVersion` argument leads to improper authentication. This allows a remote attacker to bypass authentication mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.