Cyberinsane

**Name of the Vulnerable Software and Affected Versions** SimpleMachinesForum versions 2.1.1 and earlier **Description** The issue allows remote authenticated administrators to execute arbitrary code by inserting vulnerable PHP code because themes can be modified by an administrator. The vendor's position is that administrators are intended to have the ability to modify themes and can thus choose any PHP code to be executed on the server. **Recommendations** For SimpleMachinesForum versions 2.1.1 and earlier, as a temporary workaround, consider restricting theme modification capabilities to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Abantecart versions prior to 1.3.3 **Description** The issue allows remote authenticated administrators to execute arbitrary code by uploading an executable file. This is possible because the Catalog>Media Manager>Images settings can be changed by an administrator, for example, by configuring `.php` to be a valid image file type. **Recommendations** For Abantecart versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Media Manager and limiting the types of files that can be uploaded to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** MODX Revolution versions 2.8.3-pl and earlier **Description** The issue allows remote authenticated administrators to execute arbitrary code by uploading an executable file. This is possible because the Uploadable File Types setting can be changed by an administrator, allowing for the upload of malicious files. **Recommendations** For MODX Revolution versions 2.8.3-pl and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting the Uploadable File Types setting to prevent administrators from uploading executable files. Additionally, restrict access to the file upload feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Composr-CMS versions 10.0.39 and earlier **Description** The issue allows remote attackers to execute arbitrary code via uploading a PHP shell through the "/adminzone/index.php?page=admin-commandr" API endpoint. This enables attackers to perform authenticated remote code execution. **Recommendations** For Composr-CMS versions 10.0.39 and earlier, as a temporary workaround, consider restricting access to the "/adminzone/index.php?page=admin-commandr" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.