Gaorenyusi

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 3.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 **Description** An issue exists in the Apache Camel JMS component where the `JmsBinding.extractBodyFromJms()` function in `camel-jms` (and equivalent bindings in `camel-sjms`, `camel-sjms2`, `camel-amqp`, `camel-activemq`, and `camel-activemq6`) improperly handles the deserialization of incoming JMS ObjectMessage payloads when the `mapJmsMessage` option is enabled. Although a post-deserialization class check was implemented to restrict allowed classes, the `org.apache.camel.support.DefaultExchangeHolder` class is included in the allow-list. An attacker can send a crafted ObjectMessage with a `DefaultExchangeHolder` as the top-level object to bypass this check. The system then calls `DefaultExchangeHolder.unmarshal()`, allowing the attacker to inject arbitrary Exchange state—including message bodies, headers, properties, and variables—using only trusted `java.lang` and `java.util` types. This allows for the manipulation of routing, headers, exchange properties, and error handling without requiring a deserialization gadget chain. **Recommendations** Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS release stream. Upgrade to version 4.18.3 for those on the 4.18.x release stream. Restrict publish access to the queues and topics consumed by Camel to trusted producers via JMS broker authorization. Avoid exposing JMS consumers that map ObjectMessage bodies to untrusted networks.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 **Description** The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a Java deserialization filter. When Camel builds the Hazelcast Config without a user-supplied `HazelcastInstance`, `hazelcastConfigUri`, or referenced Config bean, objects received via the Hazelcast cluster protocol are deserialized using `ObjectInputStream.readObject()` before processing. An attacker capable of joining or reaching the Hazelcast cluster can send a crafted serialized Java object, leading to remote code execution on every Camel node. This issue affects any route using a hazelcast consumer (including hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, and hazelcast-set), as well as the `HazelcastAggregationRepository` and `HazelcastIdempotentRepository`, when the managed instance uses the default configuration. **Recommendations** Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Upgrade to version 4.21.0 for all other affected versions. Configure a deserialization filter on the Hazelcast instance via `Hazelcast JavaSerializationFilterConfig` or the JVM-wide system property `-Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*`. Enable Hazelcast cluster authentication and TLS to restrict cluster access.

**Name of the Vulnerable Software and Affected Versions** yiisoft Yii2 versions up to 2.0.39 **Description** A critical issue was found in the Generate function of the file phpunitsrcFrameworkMockObjectMockClass.php. This issue leads to deserialization and can be initiated remotely. **Recommendations** For versions up to 2.0.39, update to a version higher than 2.0.39 to resolve the issue. As a temporary workaround, consider restricting access to the Generate function of the MockClass.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** yiisoft Yii2 versions up to 2.0.45 **Description** A critical issue has been found, affecting the `getIterator` function of the file `symfonyfinderIteratorSortableIterator.php`. This issue leads to deserialization and can be exploited remotely. **Recommendations** For versions up to 2.0.45, update to a version higher than 2.0.45 to resolve the issue. As a temporary workaround, consider restricting access to the `getIterator` function of the `SortableIterator.php` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Best House Rental Management System version 1.0 **Description** The issue concerns an arbitrary file upload vulnerability. This vulnerability is located in the `update account()` function of the file `rental/admin class.php`. **Recommendations** For Best House Rental Management System version 1.0, consider disabling the `update account()` function until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the `rental/admin class.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Best House Rental Management System version 1.0 **Description** The issue concerns an arbitrary file upload vulnerability. This vulnerability is located in the save settings() function of the file rental/admin class.php. **Recommendations** For Best House Rental Management System version 1.0, consider disabling the save settings() function until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the rental/admin class.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DedeCMS version 5.7.115 **Description** The issue is related to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module. This allows for potential malicious script execution. **Recommendations** For DedeCMS version 5.7.115, as a temporary workaround, consider disabling the advertisement code box in the advertisement management module until a patch is available. Restrict access to the advertisement management module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dedecms version 5.7.115 **Description** The issue is related to an arbitrary code execution via file upload vulnerability in the backend. **Recommendations** For Dedecms version 5.7.115, as a temporary workaround, consider disabling file uploads in the backend until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Best House Rental Management System version 1.0 **Description** The issue is related to a SQL injection vulnerability in the `delete category()` function, located in the file `rental/admin class.php`. This vulnerability can potentially be exploited to execute unauthorized SQL commands. **Recommendations** For Best House Rental Management System version 1.0, consider disabling the `delete category()` function until a patch is available to prevent potential SQL injection attacks. Restrict access to the `rental/admin class.php` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Best House Rental Management System version 1.0 **Description** The issue concerns an arbitrary file upload vulnerability in the `signup()` function of the file `rental/admin class.php`. This could potentially lead to system compromise. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For Best House Rental Management System version 1.0, patch immediately and validate input to prevent exploitation. As a temporary workaround, consider disabling the `signup()` function until a patch is available. Restrict access to the `rental/admin class.php` file to minimize the risk of exploitation. Avoid using the vulnerable file upload feature in the signup process until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A critical vulnerability has been found in the system. The issue affects the function `delete user/save user` of the file `/admin class.php`. The manipulation of the argument `id` leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Recommendations: For SourceCodester Best House Rental Management System version 1.0, consider disabling the `delete user/save user` function in the `/admin class.php` file until a patch is available. Restrict access to the `id` argument to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: lmxcms versions up to 1.4 Description: A critical issue was found in the function `formatData` of the file /admin.php?m=Acquisi&a=testcj&lid=1, which is part of the SQL Command Execution Module. The manipulation of the argument `data` leads to code injection. This issue can be exploited remotely. The exploit has been disclosed to the public. Recommendations: For lmxcms versions up to 1.4, as a temporary workaround, consider disabling the `formatData` function until a patch is available. Restrict access to the /admin.php?m=Acquisi&a=testcj&lid=1 endpoint to minimize the risk of exploitation. Avoid using the `data` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A critical vulnerability was found in the SourceCodester Computer Laboratory Management System. The issue affects the `delete record` function of the file `/classes/Master.php?f=delete record`. The manipulation of the `id` argument leads to SQL injection. The attack can be launched remotely. Recommendations: For SourceCodester Computer Laboratory Management System version 1.0, consider disabling the `delete record` function until a patch is available. Restrict access to the `/classes/Master.php?f=delete record` endpoint to minimize the risk of exploitation. Avoid using the `id` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A critical vulnerability has been found in the function `update settings info` of the file `/classes/SystemSettings.php?f=update settings`. The manipulation of the `name` argument leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Recommendations: For SourceCodester Computer Laboratory Management System version 1.0, consider disabling the `update settings info` function until a patch is available. Restrict access to the `/classes/SystemSettings.php?f=update settings` endpoint to minimize the risk of exploitation. Avoid using the `name` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.