Parnuski

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it was possible to create PDF templates containing `<img>` tags. When a PDF is exported using these templates, the content is rendered server-side, leading to a Server-Side Request Forgery (SSRF). Specifically, a crafted `<img>` tag, such as `<img src=http://{burp collaborator url}>`, causes the server to make a request to the specified URL. **Recommendations** Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.14.7 **Description** SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. **Recommendations** Update SuiteCRM to version 7.14.7.

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1 Description: The issue affects Opal, the core database application for biobanks or epidemiological studies. When copying any parent directory to a folder in the "/temp/" directory, all files in that parent directory are copied, including files that the user should not have access to. This means any user can exploit this to reveal all files in the Opal filesystem. Low-privilege users, such as DataShield users, can retrieve the files of other users. Recommendations: For versions prior to 5.1.1, update to version 5.1.1, which includes a patch for this issue. As a temporary workaround, consider restricting access to the "/temp/" directory to minimize the risk of exploitation. Avoid using the `/temp/` directory for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1 Description: The issue concerns insufficient protections against cross-site request forgery (CSRF) in the Opal application. The application checks the referrer header and returns a 403 error if it is invalid. However, this protection can be bypassed by dropping the referrer header from CSRF requests using `<meta name="referrer" content="never">`. Recommendations: For versions prior to 5.1.1, update to version 5.1.1 to resolve the issue.