Yingxiujie

**Name of the Vulnerable Software and Affected Versions** CodeAstro Simple Online Leave Management System version 1.0 **Description** Remote SQL injection is possible via the `/SimpleOnlineLeave/index.php` endpoint. By manipulating the `email` parameter, an attacker can execute unauthorized database queries, which could lead to the exposure of employee data within internal HR and leave-management systems. **Recommendations** Update CodeAstro Simple Online Leave Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/SimpleOnlineLeave/index.php` endpoint or sanitize the `email` parameter to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Apartment Visitor Management System version 1.0 **Description** A security flaw allows remote attackers to perform SQL injection, a technique used to manipulate database queries. The issue exists within an unknown function in the '/apartment-visitor/add-apartment.php' endpoint via the `apartmentno` variable. **Recommendations** As a temporary mitigation, restrict access to the '/apartment-visitor/add-apartment.php' endpoint or avoid using the `apartmentno` variable until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Montodel House-Rental-Management versions prior to 90010017b81265eb1ef3810268909f7719a33863 **Description** A SQL injection issue exists in the '/login.php' endpoint. Remote attackers can exploit this by manipulating the `Username` parameter. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to a version later than 90010017b81265eb1ef3810268909f7719a33863. As a temporary workaround, restrict access to the '/login.php' endpoint or sanitize the `Username` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Montodel House-Rental-Management versions prior to 90010017b81265eb1ef3810268909f7719a33863 **Description** A remote SQL injection exists in the '/index.php?page=houses' endpoint. The issue occurs due to the improper manipulation of the `ID` argument, allowing an attacker to execute arbitrary SQL commands. **Recommendations** Update to a version later than 90010017b81265eb1ef3810268909f7719a33863. As a temporary workaround, restrict access to the '/index.php?page=houses' endpoint or avoid using the `ID` parameter until the system is updated.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Online Catering Ordering System version 1.0 **Description** Remote SQL injection is possible via the manipulation of the `ID` argument in the '/deleteorder.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database. **Recommendations** Avoid using the `ID` parameter in the '/deleteorder.php' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Leave Management System version 1.0 **Description** A weakness in the `/login.php` file allows for remote SQL injection. This occurs through the manipulation of the `txt username` argument. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/login.php` file or sanitize the `txt username` input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** rawchen sims versions prior to 004f783b1db5ecdfad81c8fdc3b34171211112de **Description** A path traversal flaw exists in the 'deleteFileServlet' endpoint within the file `sims-master/src/web/servlet/file/DeleteFileServlet.java`. A remote attacker can exploit this by manipulating the `filename` argument. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** Update to a version later than 004f783b1db5ecdfad81c8fdc3b34171211112de. As a temporary workaround, restrict access to the 'deleteFileServlet' endpoint or avoid using the `filename` parameter until a patch is applied.

Name of the Vulnerable Software and Affected Versions perfree go-fastdfs-web versions up to 1.3.7 Description A security issue exists in perfree go-fastdfs-web up to version 1.3.7, specifically within the `doInstall` interface of the file src/main/java/com/perfree/controller/InstallController.java. This results in improper authorization, and the attack can be initiated remotely. The exploit has been publicly disclosed. Recommendations Update to a version later than 1.3.7.