Jiva

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form step=202 parameter in backup.php. Attackers can exploit the unfiltered shell exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure file priv settings are configured.

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** A path traversal issue exists in the attachment upload handler. Authenticated attackers can execute arbitrary code by uploading files using traversal sequences in the `unique name` parameter. By providing sequences such as ../../../shell.php, an attacker can write files outside the designated attachments directory and into the web root. Since the system lacks extension validation for uploaded PHP files, this allows for remote code execution as the web server user. **Recommendations** Update to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data. By injecting UNION SELECT payloads into the `PARAM 0` POST parameter, attackers can use malicious SQL syntax through an unparameterized WHERE clause to retrieve sensitive information, such as usernames, password hashes, and email addresses from the users table, which is then rendered in the PDF report output. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to database data. **Recommendations** Update FrontAccounting to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the Audit Trail report handler that allows authenticated attackers with SA GLANALYTIC permission to execute arbitrary SQL queries. This is achieved by injecting malicious code into the `PARAM 2` and `PARAM 3` POST parameters. Exploitation can occur via time-based blind SQL injection using `SLEEP()` functions, which can be amplified across JOIN result sets to cause a denial of service by exhausting database connections. Additionally, attackers may use UNION-based injection techniques to extract arbitrary database content. **Recommendations** Update to version 2.4.20 or later.

**Name of the Vulnerable Software and Affected Versions** FrontAccounting versions prior to 2.4.20 **Description** An issue exists in the `get gl transactions()` function where the `filter type` parameter is concatenated directly into a SQL IN() clause without parameterization. This allows users with SA GLANALYTIC permissions to perform boolean-based blind SQL injection—a technique used to extract data by observing differences in server responses to true or false queries—by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data. **Recommendations** Update FrontAccounting to version 2.4.20 or later. As a temporary workaround, restrict the SA GLANALYTIC permission to trusted users only.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP/CRM versions prior to 23.0.2 **Description** An authenticated remote code execution issue exists in the `dol eval standard()` function. The system fails to apply forbidden string checks when operating in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via `eval()`. The root cause is that the `$forbiddenphpstrings` blocklist is only enforced in blacklist mode, while the whitelist regex is blind to PHP dynamic callable syntax. **Recommendations** Update to version 23.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 9.3.4 **Description** The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as `Attachment.sourceId`. This allows modification of the `sourceId` via a formula, leading to a path traversal issue when the `getFilePath()` function is used without proper sanitization. An attacker can upload a webshell using chunked upload, poison the `.htaccess` file, and achieve Remote Code Execution (RCE) as the `www-data` user. Exploitation requires admin credentials and six requests. The vulnerable component is the formula engine and the `getFilePath()` function. The `sourceId` variable is directly concatenated into a file path without sanitization. **Recommendations** Update to EspoCRM version 9.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM versions prior to 8.4.1 **Description** An authenticated remote code execution issue exists in the admin module import feature. Administrator-level attackers can upload arbitrary PHP files by submitting a crafted zip archive through the `ModuleManager` import function. The system extracts contents directly into the `modules/` directory under the web root without validating file types beyond the `manifest.xml` descriptor. This allows attackers to place executable PHP files in the `modules/` directory that are directly accessible via HTTP, bypassing the authentication and authorization layer because the web server resolves the path and invokes the PHP interpreter before the application routing layer is involved, creating a persistent web shell. **Recommendations** Update Vtiger CRM to a version newer than 8.4.0. Restrict access to the `ModuleManager` import function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Vtiger CRM versions prior to 8.4.0 **Description** An authenticated file upload issue exists in the Documents module that allows low-privileged users to achieve remote code execution. This occurs because the extension denylist in `config.inc.php` omits the `.phar` extension, enabling the upload of files containing arbitrary PHP code. These files are stored with their original extension in a web-accessible directory. Furthermore, on Apache 2.4 deployments, a misconfigured `.htaccess` file using Apache 2.2 syntax is ignored, which allows unauthenticated HTTP requests to execute the uploaded PHP payload. **Recommendations** Update Vtiger CRM to version 8.4.0 or later.