Mehmet Emiroglu

**Name of the Vulnerable Software and Affected Versions** Newsbull Haber Script version 1.0.0 **Description** Authenticated attackers can extract database information using time-based, blind, and boolean-based SQL injection techniques. This occurs when malicious SQL code is injected through the `search` parameter in the following endpoints: '/admin/comment/records', '/admin/category/records', '/admin/news/records', and '/admin/menu/childs'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** qdPM version 9.1 **Description** An SQL injection flaw allows attackers to manipulate database queries by injecting SQL code. This is achieved by sending POST requests to the users endpoint using malicious values in the `search by extrafields[]` parameter, which can trigger SQL syntax errors and lead to the extraction of database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PilusCart version 1.4.1 **Description** An issue allows unauthenticated attackers to manipulate database queries by injecting SQL code. This is achieved by sending POST requests to the comment submission endpoint using the `send` parameter with RLIKE-based boolean SQL injection payloads to extract sensitive information from the database. Boolean SQL injection is a technique that asks the database true or false questions to infer data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenDocMan version 1.3.4 **Description** An SQL injection allows unauthenticated attackers to manipulate database queries by injecting SQL code. This is achieved by sending GET requests to the 'search.php' endpoint using malicious payloads in the `where` parameter to extract sensitive database information. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to view data they are not normally able to retrieve. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `where` parameter in the 'search.php' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection issue exists that allows attackers to manipulate database queries by injecting SQL code. This is achieved by sending crafted requests containing malicious SQL payloads through the `mng profile id` parameter to extract sensitive database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter `mng profile id` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw exists where attackers can manipulate database queries by injecting malicious SQL code. This is achieved by sending crafted requests through the `id to modify` parameter, potentially allowing the extraction of sensitive database information or the unauthorized modification of data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `id to modify` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw allows unauthenticated attackers to manipulate database queries. This is achieved by injecting SQL code through the `user2reset` parameter, enabling the extraction of sensitive information or the modification of data within the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `user2reset` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw exists where attackers can manipulate database queries by injecting malicious SQL code. This is achieved through the `language tag` parameter, allowing the extraction of sensitive database information or the modification of data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `language tag` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw allows attackers to manipulate database queries by injecting malicious SQL code. This is achieved by sending crafted requests through the `id to delete` parameter, which can lead to the extraction or modification of sensitive database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `id to delete` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection issue exists where attackers can manipulate database queries by injecting SQL code. This is achieved through the `sort direction` parameter, allowing the submission of malicious SQL statements to extract sensitive database information or modify data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter `sort direction` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw allows attackers to manipulate database queries by injecting SQL code through the `id project` parameter. This can be exploited by sending crafted requests containing malicious SQL statements to extract sensitive information from the database or modify existing data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `id project` parameter in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kados R10 GreenBee (affected versions not specified) **Description** An SQL injection flaw allows attackers to manipulate database queries by injecting SQL code through the `filter user mail` parameter. This can be exploited by sending crafted requests with malicious SQL statements to extract sensitive information from the database or modify data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `filter user mail` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM version 7.10.7 **Description** Authenticated attackers can manipulate database queries by injecting SQL code through the `parentTab` parameter. By sending GET requests to the email module with malicious values, attackers can use boolean-based SQL injection—a technique that asks the database true or false questions to infer data—to extract sensitive information from the database. **Recommendations** As a temporary workaround, avoid using the `parentTab` parameter in the email module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM version 7.10.7 **Description** Authenticated attackers can manipulate database queries via a time-based blind SQL injection. This occurs when SQL code is appended to the `record` parameter in GET requests sent to the 'index.php' endpoint within the Users module DetailView action. This technique allows for the extraction of sensitive information from the database by analyzing the time the server takes to respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `record` parameter in the 'index.php' endpoint of the Users module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** eNdonesia Portal version 8.7 **Description** Unauthenticated attackers can execute arbitrary SQL queries by injecting malicious code through the `bid` parameter. This is achieved by sending GET requests to the 'banners.php' endpoint with crafted SQL payloads to extract sensitive database information from the INFORMATION SCHEMA tables. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Varient version 1.6.1 **Description** An SQL injection issue exists that allows unauthenticated attackers to manipulate database queries. This is achieved by injecting SQL code through the `user id` parameter. Attackers can send POST requests with crafted SQL payloads in the `user id` field to bypass authentication and extract sensitive database information. The vulnerable API endpoint accepts POST requests with the `user id` parameter. **Recommendations** Apply a fix for Varient version 1.6.1.

**Name of the Vulnerable Software and Affected Versions** osCommerce version 2.3.4.1 **Description** The software contains a SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through the `reviews id` parameter. By sending GET requests to the ''product reviews write.php'' endpoint with malicious `reviews id` values using boolean-based SQL injection payloads, attackers can extract sensitive database information. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ''product reviews write.php'' endpoint. Sanitize the `reviews id` parameter to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** osCommerce version 2.3.4.1 **Description** The software contains a SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through the `products id` parameter. Specifically, modifying the `products id` value in requests to the 'product info.php' resource and appending boolean-based SQL injection payloads allows extraction of sensitive database information. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the `products id` parameter in 'product info.php' requests to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** osCommerce version 2.3.4.1 **Description** The software contains a SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through the `currency` parameter. By sending GET requests to the ''shopping cart.php'' endpoint with malicious `currency` values using boolean-based SQL injection payloads, attackers can extract sensitive database information. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the ''shopping cart.php'' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HotelDruid version 2.3.0 **Description** The issue affects the `nsextt`, `cambia1`, `mese fine`, `origine`, and `anno` parameters in several PHP files, including `creaprezzi.php`, `tabella3.php`, `personalizza.php`, and `visualizza tabelle.php`, allowing for XSS exploitation. **Recommendations** For HotelDruid version 2.3.0, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, avoid using the `nsextt`, `cambia1`, `mese fine`, `origine`, and `anno` parameters in the affected API endpoints until the issue is resolved.