Filipe Cordeiro

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows for XSS via the "admin/logs ajax.php" endpoint, specifically through the `tipo` parameter. An attacker can exploit this to read the `centralmka2` (session token) cookie, which is not set to HTTPOnly. **Recommendations** For MK-AUTH versions through 19.01 K4.9, consider restricting access to the "admin/logs ajax.php" endpoint until a patch is available. As a temporary workaround, avoid using the `tipo` parameter in the affected endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows for Cross-Site Request Forgery (CSRF) attacks, which can lead to unauthorized password changes. This is possible via the "central/executar central.php?acao=altsenha princ" URI. **Recommendations** For MK-AUTH versions through 19.01 K4.9, consider disabling access to the central/executar central.php?acao=altsenha princ URI as a temporary workaround until a patch is available. Restricting the functionality related to password changes can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows remote attackers to obtain sensitive information, such as a CPF number, by modifying the `titulo` (also known as invoice number) value in the "central/recibo.php" URI. **Recommendations** For MK-AUTH versions through 19.01 K4.9, as a temporary workaround, consider restricting access to the "central/recibo.php" URI until a patch is available. Avoid using modified `titulo` values in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.