Hubert Wojciechowski

**Name of the Vulnerable Software and Affected Versions** Aero CMS version 0.0.1 **Description** An authenticated attacker can execute arbitrary PHP code by uploading malicious files. This is achieved by uploading PHP files containing embedded code to the 'admin posts.php' endpoint using the `source=add post` parameter via the `image` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenCart version 3.0.3.8 **Description** A session fixation issue exists where attackers can hijack user sessions by injecting arbitrary values into the `OCSESSID` cookie. The server accepts and maintains these malicious cookie values, which enables session takeover and unauthorized access to user accounts. **Recommendations** Update OpenCart version 3.0.3.8 to a patched version.

**Name of the Vulnerable Software and Affected Versions** e107 CMS version 3.2.1 **Description** e107 CMS version 3.2.1 is affected by multiple cross-site scripting (XSS) issues. A reflected XSS exists in the news comment functionality, triggered when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through a URL parameter, which executes when users click outside the comment field after typing content. Additionally, an upload restriction bypass for authenticated administrators allows the upload of SVG files containing malicious code via the media manager’s remote URL upload feature, leading to stored XSS when these files are accessed. The affected components are `news.php` and `image.php`. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user inputs in the comment form of the `news.php` component. Restrict administrator privileges to prevent unauthorized file uploads through the media manager in the `image.php` component.

**Name of the Vulnerable Software and Affected Versions** e107 CMS version 3.2.1 **Description** An authenticated administrator can bypass upload restrictions in e107 CMS. This allows the upload of malicious SVG files through the media manager. Successful exploitation enables attackers to upload SVG files containing cross-site scripting (XSS) payloads. When viewed, these payloads can execute arbitrary scripts. The vulnerable functionality is related to file uploads via the media manager. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** e107 CMS version 3.2.1 **Description** e107 CMS version 3.2.1 has a file upload issue. Authenticated administrative users can bypass upload restrictions and execute PHP files. An attacker can upload malicious PHP files to parent directories by manipulating the upload URL parameter. This allows for remote code execution through the Media Manager import feature. The vulnerable parameter is the `upload URL` parameter. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** e107 CMS version 3.2.1 **Description** The application contains a file upload issue that allows administrators with authentication to overwrite server files using the Media Manager import functionality. Specifically, attackers can manipulate the upload URL parameter to overwrite files such as `top.php` within the web application directory. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Media Manager import functionality.

**Name of the Vulnerable Software and Affected Versions** e107 CMS version 3.2.1 **Description** e107 CMS version 3.2.1 has a file upload issue. Authenticated administrators can overwrite server files using path traversal. The issue is located in the Media Manager’s remote URL upload functionality, specifically in the `image.php` component. The `upload caption` parameter is not properly sanitized, allowing attackers to use directory traversal sequences (../../../) to overwrite system files outside the intended upload directory. This could lead to a complete compromise of the web application by overwriting configuration files or executable scripts. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict administrative privileges to trusted personnel only.

**Name of the Vulnerable Software and Affected Versions** Orangescrum version 1.8.0 **Description** The application has multiple cross-site scripting issues that permit authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters such as `projid`, `CS message`, and `name` to execute arbitrary JavaScript code in victim’s browsers by submitting crafted payloads through application endpoints. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Orangescrum version 1.8.0 **Description** Orangescrum version 1.8.0 has an authenticated SQL injection issue. Authorized users can manipulate database queries through vulnerable parameters. Specifically, attackers can inject malicious SQL code into parameters such as `old project id`, `project id`, `uuid`, and `uniqid`. This could allow for the extraction or modification of database information. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Orangescrum version 1.8.0 **Description** An authenticated user can take over other project-assigned accounts by manipulating session cookies, leading to privilege escalation. An attacker can extract a victim's unique ID from the page source and replace their own session cookie to gain unauthorized access. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider regularly rotating session cookies to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Atom CMS version 2.0 **Description** Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the `id` parameter of the admin index page to execute time-based blind SQL injection attacks. The vulnerability allows for remote database manipulation via the unvalidated `id` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebTareas version 2.4 **Description** WebTareas 2.4 contains a SQL injection issue in the `webTareasSID` cookie parameter. This allows unauthenticated attackers to manipulate database queries. Attackers can use error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data. The `webTareasSID` parameter is susceptible to this manipulation. **Recommendations** WebTareas version 2.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebTareas version 2.4 **Description** WebTareas 2.4 has a file upload issue that permits authenticated users to upload malicious PHP files via the chat photo upload feature. An attacker can upload a PHP file containing arbitrary code to the `/files/Messages/` directory and then execute it directly using the generated file path. The vulnerability allows for remote code execution. **Recommendations** WebTareas version 2.4: Restrict file uploads in the chat photo upload functionality.