Jbince

**Name of the Vulnerable Software and Affected Versions** Mantis Bug Tracker versions prior to 2.28.1 **Description** Mantis Bug Tracker (MantisBT) is an open source issue tracker. An authentication bypass exists in the SOAP API when running on MySQL family databases due to improper type checking on the `password` parameter. This occurs because MySQL performs implicit type conversion from string to integer. An attacker who knows a victim's username can use a crafted SOAP envelope to log in to the SOAP API without the actual password and execute any API function available to that account. This can allow an attacker to log in as an administrator using the password "0" to gain full project access. **Recommendations** Update to version 2.28.1. As a temporary workaround, disable the SOAP API to significantly reduce the risk, although this may still allow the retrieval of user account information such as email addresses and real names.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Before versions 7.15.1 and 8.9.3, the `action exportCustom` function in `modules/ModuleBuilder/controller.php` does not properly neutralize path traversal sequences in the `modules` and `name` parameters. These parameters are then used in the `exportCustom` function within `modules/ModuleBuilder/MB/MBPackage.php` to construct file paths for reading and writing. This allows a user with access to the ModuleBuilder module, typically an administrator, to create a request that can copy the content of any readable directory on the underlying host into the web root, making it accessible. The `ModuleBuilder` module is present in both major versions 7 and 8, affecting both current major versions. This allows an attacker to copy any readable directory into the web root, potentially exposing sensitive information like system files, including the content of `/etc`, or the web server's root directory, and environment variables. **Recommendations** SuiteCRM versions prior to 7.15.1 should be updated to version 7.15.1 or later. SuiteCRM versions prior to 8.9.3 should be updated to version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()` function in `include/OutboundEmail/OutboundEmail.php` does not properly neutralize the user-controlled `$id` parameter. The function relies on calling functions to sanitize user input, but this is not consistently applied in all locations, specifically through the `EmailUIAjax` action on the `Email()` module. This allows an authenticated user to potentially perform SQL injection through the `retrieve()` function. An attacker could retrieve arbitrary information from the database, including user information and password hashes. The vulnerable code resides in the `retrieve()` function. **Recommendations** SuiteCRM versions prior to 7.15.1 should be updated to version 7.15.1 or later. SuiteCRM versions prior to 8.9.3 should be updated to version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is a customer relationship management software application. An authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and multi-factor authentication (MFA) configuration. Because any authenticated user can query this endpoint, it is possible to retrieve and potentially crack the passwords of administrative users. The vulnerable API endpoint allows unauthorized access to sensitive user data. **Recommendations** Update to version 8.9.3 or later.