Yassine Damiri

**Name of the Vulnerable Software and Affected Versions** Nginx Proxy Manager versions 2.9.14 through 2.15.1 **Description** An authenticated remote code execution issue exists via OS command injection in the `setupCertbotPlugins()` function located in backend/setup.js. Attackers with `certificates:manage` permissions can execute arbitrary commands by storing a malicious payload in the `dns provider credentials` field. This occurs because the `dns provider credentials` value is interpolated directly into a shell command executed via `child process.exec()` without proper sanitization or escaping, leading to command execution upon backend restart. **Recommendations** Update to the version containing commit a5db5ed. As a temporary mitigation, restrict the `certificates:manage` permission to trusted administrators only.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** An unauthenticated SQL injection exists in the login functionality. The `login` variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict access to the authentication endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A ZipSlip path traversal issue exists in the plugin upload functionality. Authenticated attackers with upload permissions can write files outside the intended extraction directory by using ZIP archives containing directory traversal sequences. This unvalidated archive extraction allows for the placement of a PHP webshell in a web-accessible directory, leading to remote code execution with the privileges of the web server process. The issue is located in the 'uploadPlugin.php' endpoint. **Recommendations** Update to version 12.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** Authenticated users with guest-level privileges can retrieve sensitive data belonging to other users, such as password hashes and API keys. This occurs due to missing authorization in the 'objectDetail.php' endpoint, allowing attackers to bypass access controls without ownership or role-based validation to extract administrator credentials and perform privilege escalation. **Recommendations** Update to version 12.4.4. As a temporary workaround, restrict access to the 'objectDetail.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A stored cross-site scripting issue exists in the `checkValidHtmlText()` function within Security.php. The function fails to properly sanitize user input because it only detects specific patterns and returns unsanitized strings without output encoding. This allows attackers to inject malicious payloads using alternative syntax, such as img tags with event handlers, which are then stored and executed in the browsers of users who view the affected content. **Recommendations** Update to version 12.4.4. As a temporary workaround, restrict access to the `checkValidHtmlText()` function within Security.php to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A stored cross-site scripting issue exists in the file upload functionality. The `checkValidFileName()` function fails to restrict the upload of HTML and HTM files. Authenticated attackers can upload files containing arbitrary JavaScript through the image upload or attachment endpoints. When a user accesses the URL of the uploaded file, the embedded JavaScript executes within their browser. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict the use of the `checkValidFileName()` function or the image upload and attachment endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjeQtor versions 7.0 through 12.4.3 **Description** A path traversal issue exists in the log file viewer. Authenticated attackers can inject directory traversal sequences into the `logname` parameter at the 'dynamicDialog.php' endpoint to read arbitrary .log files accessible to the web server process on the filesystem. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 12.4.4 or later. As a temporary workaround, restrict access to the 'dynamicDialog.php' endpoint or avoid using the `logname` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Yi IOT XY-3820 version 6.0.24.10 **Description** The issue concerns Remote Command Execution via the `cmd listen` function located in the `cmd` binary. **Recommendations** For Yi IOT XY-3820 version 6.0.24.10, as a temporary workaround, consider disabling the `cmd listen` function until a patch is available. Restrict access to the `cmd` binary to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: LSC Smart Connect LSC Indoor PTZ Camera version 7.6.32 Description: The issue concerns a remote code execution (RCE) vulnerability in the `tuya ipc direct connect` function of the `anyka ipc` process. This vulnerability allows for arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera. Recommendations: For LSC Smart Connect LSC Indoor PTZ Camera version 7.6.32, as a temporary workaround, consider disabling the `tuya ipc direct connect` function until a patch is available. Restrict access to the Wi-Fi configuration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.