Ibram Marzouk

**Name of the Vulnerable Software and Affected Versions** PHP FormMail Generator versions prior to 17 December 2016 **Description** The issue concerns the unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. However, this list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename. **Recommendations** For versions prior to 17 December 2016, consider updating the form.lib.php file to include all variations of PHP files in the list of dangerous extensions to prevent the upload of malicious PHP files. As a temporary workaround, consider restricting the upload of files with PHP extensions or disabling the file upload feature until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** PHP FormMail Generator versions prior to 17 December 2016 **Description** The issue concerns stored cross-site scripting in the code generated by PHP FormMail Generator. The generated form.lib.php file checks upload file types against a hard-coded list of dangerous extensions, but this list does not include all variations of PHP files. This may allow execution of the contained PHP code if an attacker can guess the uploaded filename, as the form appends a short random string to the end of the filename by default. **Recommendations** For versions prior to 17 December 2016, consider updating the form.lib.php file to include all variations of PHP files in the list of dangerous extensions to prevent potential execution of malicious PHP code. As a temporary workaround, restrict the upload of PHP files and consider disabling the file upload feature until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** Zulip Server versions 1.5.1 and below **Description** The issue arises from an error in the implementation of the `invite by admins only` setting in the Zulip group chat application server. This error allows an authenticated user to invite other users to join a Zulip organization, even if the organization is configured to prevent this action. **Recommendations** For Zulip Server versions 1.5.1 and below, as a temporary workaround, consider disabling the invite functionality until a patch is available. Restrict access to the organization's settings to minimize the risk of exploitation. Avoid using the `invite by admins only` setting in configurations where it is intended to restrict invitations.