Lihongming

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Electronic Judging System version 1.0 **Description** A SQL injection issue exists in the `/intrams/admin/add judges.php` endpoint. This occurs when the `fname` argument is manipulated, allowing a remote attacker to execute unauthorized database queries. **Recommendations** Update itsourcecode Electronic Judging System to a version that fixes this issue. As a temporary mitigation, restrict access to the `/intrams/admin/add judges.php` endpoint or avoid using the `fname` parameter until a patch is applied.