Shoui Tseng

**Name of the Vulnerable Software and Affected Versions** Webopac from Grand Vice info (affected versions not specified) **Description** The issue is a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webopac from Grand Vice info (affected versions not specified) **Description** The issue concerns a problem with file type validation in Webopac from Grand Vice info, allowing remote attackers with regular privileges to upload and execute webshells. This could lead to arbitrary code execution on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Grand Vice Info Webopac versions up to 6.5.0/7.2.2 **Description** The issue is related to the lack of proper file type validation in the Webopac component, allowing unauthenticated remote attackers to upload and execute webshells. This could lead to arbitrary code execution on the server, potentially resulting in server compromise. **Recommendations** For versions up to 6.5.0/7.2.2, upgrade the affected components immediately to mitigate exposure. As a temporary workaround, consider restricting access to the Webopac component until a patch is available. Avoid using the Webopac component for uploading files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Webopac from Grand Vice info (affected versions not specified) **Description** The issue is a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webopac from Grand Vice info (affected versions not specified) **Description** The Webopac system has a SQL Injection flaw, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webopac from Grand Vice info (affected versions not specified) **Description** The issue is a Stored Cross-site Scripting vulnerability, allowing remote attackers with regular privileges to inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.