Ghufran Khan

Name of the Vulnerable Software and Affected Versions hcengineering Huly Platform version 0.7.382 Description A server-side request forgery condition exists in hcengineering Huly Platform version 0.7.382. The issue is located in an unknown part of the file server/front/src/index.ts within the Import Endpoint component. This manipulation can be exploited remotely. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions hcengineering Huly Platform version 0.7.382 Description A vulnerability exists in hcengineering Huly Platform version 0.7.382 related to the JWT Token Handler component, specifically within the file `foundations/core/packages/token/src/token.ts`. The issue involves the manipulation of the `SERVER SECRET` argument with a specific input `secret`, leading to the use of a hard-coded cryptographic key. This manipulation can be initiated remotely and is considered to have high complexity, but exploitation is difficult. Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the JWT Token Handler component or the `token.ts` file until a patch is available.

Name of the Vulnerable Software and Affected Versions Casdoor version 2.356.0 Description A flaw exists in the OAuth Authorization Request Handler component that allows for open redirect attacks. Manipulation of the `redirect uri` argument can be exploited remotely. The exploit is publicly available. Recommendations Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BookStack versions prior to 26.03.1 **Description** An issue exists in the Chapter Export Handler component within the `chapterToMarkdown()` function of the `app/Exports/ExportFormatter.php` file. A remote attacker can manipulate the `pages` argument to bypass access controls. **Recommendations** Upgrade to version 26.03.1.

Name of the Vulnerable Software and Affected Versions Casdoor version 2.356.0 Description A weakness exists in the Webhook URL Handler component that could allow for server-side request forgery (SSRF). This can be triggered remotely by manipulating the system. The vendor was contacted but did not respond. Recommendations Update to a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Casdoor version 2.356.0 Description A security flaw exists in the `dangerouslySetInnerHTML` function of Casdoor 2.356.0. Manipulation of the `formCss`/`formCssMobile`/`formSideHtml` argument can lead to cross-site scripting (XSS). This attack can be initiated remotely. The exploit has been publicly released. Recommendations Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** chatwoot versions prior to 4.11.3 **Description** An issue exists in the Webhook API component within the `Webhooks::Trigger` function located in the `lib/webhooks/trigger.rb` library. Manipulation of the `url` argument allows a remote attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources. **Recommendations** Update chatwoot to version 4.11.3 or later. As a temporary mitigation, restrict access to the `Webhooks::Trigger` function or validate the `url` argument to prevent unauthorized requests.

**Name of the Vulnerable Software and Affected Versions** mickasmt next-saas-stripe-starter version 1.0.0 **Description** A security issue exists in mickasmt next-saas-stripe-starter 1.0.0. The `generateUserStripe` function within the `actions/generate-user-stripe.ts` file of the Checkout Handler component is susceptible to business logic errors due to manipulation of the `priceId` argument. This issue can be initiated remotely. **Recommendations** As a temporary workaround, consider restricting the use of the `generateUserStripe` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** mickasmt next-saas-stripe-starter version 1.0.0 **Description** A flaw exists in the `openCustomerPortal` function within the `actions/open-customer-portal.ts` file of the Stripe API component. This manipulation can lead to an authorization bypass. Remote exploitation is possible, but the complexity is high and exploitation is difficult. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mickasmt next-saas-stripe-starter version 1.0.0 **Description** An authorization issue exists due to improper authorization when manipulating the `userId`/`role` argument within the `updateUserrole` function in the file actions/update-user-role.ts. This allows for remote exploitation. The function `updateUserrole` is affected. **Recommendations** Address the improper authorization in the `updateUserrole` function of the actions/update-user-role.ts file.

**Name of the Vulnerable Software and Affected Versions** go2ismail Asp.Net-Core-Inventory-Order-Management-System versions prior to 9.20250118 **Description** A flaw exists in go2ismail Asp.Net-Core-Inventory-Order-Management-System. The issue resides in an unknown function within the Administrative Interface component. Successful exploitation allows for execution after redirection and can be initiated remotely. The exploit for this issue has been publicly disclosed, and the vendor was notified but did not respond. **Recommendations** Update go2ismail Asp.Net-Core-Inventory-Order-Management-System to a version later than 9.20250118.

Name of the Vulnerable Software and Affected Versions go2ismail Free-CRM versions prior to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 Description A flaw exists in go2ismail Free-CRM. This issue impacts an unknown part of the `/api/Security/` file within the Security API component, potentially leading to improper authorization. The attack can be carried out remotely, and a public exploit is available. The product utilizes a rolling release strategy, making specific version details for affected or updated releases unavailable. The vendor was contacted regarding this disclosure but did not respond. Recommendations Update to a version prior to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1.

**Name of the Vulnerable Software and Affected Versions** go2ismail Free-CRM versions prior to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 **Description** A flaw exists in go2ismail Free-CRM’s Administrative Interface component that allows for code execution after redirection via remote manipulation. The vendor was notified of this issue but did not respond. The product uses a rolling release model, making specific version information for affected or updated releases unavailable. The exploit has been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** go2ismail Asp.Net-Core-Inventory-Order-Management-System versions prior to 9.20250118 **Description** A flaw exists in the software that allows for improper authorization through manipulation of an unknown functionality within the `/api/Security/` file of the Security API component. Remote exploitation is possible. The vendor was contacted regarding this issue but did not respond. **Recommendations** Update to a version later than 9.20250118.