Djvirus9

**Name of the Vulnerable Software and Affected Versions** Traccar versions 6.11.1 through 6.12.x **Description** The CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. This allows an attacker to inject spreadsheet formulas through exported fields. If a manager or administrator opens the resulting CSV file in spreadsheet software, it can trigger formula execution, potentially leading to command execution or data exfiltration. **Recommendations** Update to version 6.13.0.

**Name of the Vulnerable Software and Affected Versions** org.traccar:traccar versions 6.11.1 through 6.12.x **Description** Email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. A low-privileged attacker can store crafted HTML in these fields, which is then rendered in notification emails sent to other users who have access to the affected devices. This can result in phishing or spoofed email content. **Recommendations** Update to version 6.13.0.

**Name of the Vulnerable Software and Affected Versions** org.traccar:traccar versions 6.11.1 through 6.12.x **Description** The KML and GPX export functionality writes device names to XML output without proper escaping. A low-privileged attacker can create a device with a crafted name to inject XML content into exported files. When another user exports and opens the affected file, it can lead to corruption of the file structure and spoofing of exported location data. **Recommendations** Update to version 6.13.0.

**Name of the Vulnerable Software and Affected Versions** MobSF versions prior to 4.4.6 **Description** MobSF, a mobile application security testing tool, contains a flaw in its `read sqlite()` function located in `mobsf/MobSF/utils.py` (lines 542-566). This function utilizes Python string formatting (`%`) to construct SQL queries using table names obtained from a SQLite database's `sqlite master` table. When analyzing a malicious mobile application with a crafted SQLite database, attacker-controlled table names are directly interpolated into SQL queries without proper parameterization or escaping. This can lead to denial of service, as a malicious table name can cause the database viewer to crash, preventing analysis of the database content. It also allows for SQL injection via `UNION SELECT`, potentially enabling an attacker to retrieve attacker-controlled data. The vulnerable code is triggered when an analyst views a `.db` file during dynamic or static analysis. The `PRAGMA table info()` statement on line 553 and the `SELECT * FROM` query on line 557 are the injection points. **Recommendations** Versions prior to 4.4.6: Upgrade to version 4.4.6 or later to address the issue. The suggested fix involves replacing string formatting with properly quoted identifiers, escaping any double quotes within table names by doubling them (`"` → `""`) to prevent breakout from the double-quoted identifier context.

**Name of the Vulnerable Software and Affected Versions** Traccar versions up to and including 6.11.1 **Description** The Traccar GPS tracking system is affected by an issue where authenticated users with device creation or editing privileges can manipulate the `uniqueId` parameter to specify an absolute file path. This allows writing files outside the intended media directory because the system does not adequately validate that the resolved path remains within the designated media root during device image uploads. **Recommendations** Versions prior to 6.11.1 are recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Traccar versions up to and including 6.11.1 **Description** The Traccar open-source GPS tracking system is affected by an issue where authenticated users can obtain OAuth 2.0 authorization codes through an open redirect flaw in two OpenID Connect (OIDC)-related endpoints. The `redirect uri` parameter is not properly validated against a whitelist, allowing attackers to redirect authorization codes to URLs under their control. This can lead to account takeover on any application integrated with OAuth. **Recommendations** Versions up to and including 6.11.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Traccar versions 6.11.1 and later **Description** Traccar, an open-source GPS tracking system, is affected by a stored cross-site scripting (XSS) issue. Authenticated users can upload malicious SVG files as device images. The application does not sanitize these files and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute in the context of other users' browsers. The vulnerability allows for the execution of arbitrary JavaScript. The **API Endpoint** for file uploads is implicated in this issue. The vulnerable parameter is the SVG file itself, specifically the embedded JavaScript within the SVG file. **Recommendations** Traccar versions 6.11.1 and later: At the moment, there is no information about a newer version that contains a fix for this vulnerability.