Askar

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.

يسمح عدم تحييد وسوم HTML المتعلقة بالنصوص البرمجية بحقن الكود. تنبع هذه المشكلة من فقدان ترميز قيم الماكرو التي يوفرها المستخدم قبل تنفيذ دالة `do shortcode()`، مما يسمح بتفسير قيم الحقول المرسلة كصيغة shortcode. يمكن للمهاجمين غير المصرح لهم حقن shortcodes عشوائية من خلال قيم حقول النموذج التي يتم تنفيذها على الخادم عند معالجتها بواسطة إعدادات Send Email أو Call Webhook أو Redirect To Page أو Media.

يعاني المكون الإضافي من ثغرة تسمح بحقن HTML وحقن الكود بسبب عدم تحييد وسوم HTML المتعلقة بالبرمجيات النصية بشكل صحيح. يحدث هذا لأن إجراء AJAX `mep submit rsvp` يفشل في إجراء فحوصات تفويض نوع المنشور وتفويض الأعضاء، ويستخدم nonce عام `mep rsvp nonce` غير مرتبط بحدث معين يمكن لأي زائر الحصول عليه من صفحات الأحداث العامة. نتيجة لذلك، يمكن للمهاجمين غير المصرح لهم حقن محتوى HTML تعسفي عبر بيانات POST `attendee fields` والتي قد يتم عرضها في واجهة الإدارة أو مخرجات التأكيد.

The issue allows Remote Command Execution as a Root user. This is achieved by injecting a malicious command inside the config file, which is then triggered by another part of the software.

The issue allows for Remote Command Execution via shell metacharacters in the `require/commandLine/CommandLine.php` file. This is due to the mishandling of the `mib file` in `plugins/main sections/ms config/ms snmp config.php`, specifically in the `get mib oid` function.

An issue was discovered in Open-AudIT where shell metacharacter injection is possible via attributes to an "open-audit/configuration/" URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings, internally referred to as `exclude ip`. This `exclude ip` value is passed to the `exec` function in the `discoveries helper.php` file, specifically inside the `all ip list` function, without being filtered. As a result, the attacker can provide a payload instead of a valid IP address.

The issue in Cacti's graph realtime.php file is related to the lack of neutralization of special elements, which can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted request. This can be achieved via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the `ip src` parameter in an "index.php?operation/netflow/nf live view" request. This is due to a problem in the `netflow get stats` function in `functions netflow.php`.

An issue allows an attacker to directly execute system commands by sending a GET request to "search.crud.php" because the `catCommand` parameter is passed to the `exec` function without filtering, which can lead to command execution.

An issue allows an attacker to directly execute system commands by sending a GET request to "ajaxServerSettingsChk.php" because the `rootUname` parameter is passed to the `exec` function without filtering, which can lead to command execution.

The issue allows an attacker to execute arbitrary system commands. This is achieved by submitting a malicious command to the service edit.php file, which inserts the command into the database. The stored command can be triggered by calling the services.php file via a GET request with the service id followed by the parameter `a=start`.

The issue allows an attacker to execute arbitrary system commands. This is achieved by using the value `init script` in "Monitoring Engine Binary" in `main.get.php` to insert an arbitrary command into the database. The command is then executed by calling the vulnerable page "www/include/configuration/configGenerate/xml/generateFiles.php", which passes the inserted value to the database to `shell exec` without sanitizing it, thus allowing the execution of arbitrary system commands.

Name of the Vulnerable Software and Affected Versions: LibreNMS version 1.46 Description: The issue allows remote attackers to execute arbitrary OS commands. This is achieved by using the `community` parameter in the `html/pages/addhost.inc.php` page during the creation of a new device. Then, by making a request to the `/ajax output.php?id=capture&format=text&type=snmpwalk&hostname=localhost` endpoint, it triggers command mishandling in `html/includes/output/capture.inc.php`. Recommendations: For LibreNMS version 1.46, as a temporary workaround, consider restricting access to the `html/pages/addhost.inc.php` page and the `/ajax output.php` endpoint to minimize the risk of exploitation. Avoid using the `community` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.